The admin template editor in magicblack maccms10 (application/admin/controller/Template.php) attempts to block dangerous PHP functions in template content using a blacklist regex. However, the blacklist omitted functions such as exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Because the ThinkPHP {if} template tag embeds the condition attribute directly into raw PHP, an authenticated administrator can inject arbitrary PHP code. For example, a payload like {if condition="exec('id > /tmp/pwned.txt')"}{/if} can be used to execute system commands. The vulnerability was fixed in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 on 2026-06-22 by adding the missing functions to the blacklist filter.

An authenticated administrator can exploit this vulnerability to execute arbitrary PHP code on the server, leading to remote code execution with the privileges of the web application. This can result in full compromise of the affected system, including confidentiality, integrity, and availability impacts.

A fix is available and was implemented in commit 71ad3bb29570e110d8e973acff68040a3050ddf0 on 2026-06-22, which added the missing dangerous PHP functions to the blacklist filter in the template editor. Users should update to a version including this commit. No other mitigation guidance is provided.