This vulnerability affects the evaluate function in the app/modules/view/src/PhpEngine.php component of Pagekit CMS (up to version 1.0.18). It results from improper neutralization of directives in dynamically evaluated code, which can be remotely exploited. The issue allows attackers with high privileges to influence code evaluation, potentially leading to limited confidentiality, integrity, and availability impacts. The vendor has not provided any advisory or patch, and the exploit code is publicly accessible.

Successful exploitation can lead to unauthorized code execution within the context of the CMS, potentially compromising confidentiality, integrity, and availability to a limited extent. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and high privileges required, with low impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported beyond public exploit availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by restricting access to the vulnerable evaluate function or limiting high privilege user capabilities until an official patch is available.