This vulnerability in magicblack MacCMS10 2026.1000.4055 involves OS command injection via manipulation of the Template Handler component's file path. The attack can be initiated remotely without user interaction and requires high privileges. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, but requiring high privileges and with limited impact on confidentiality, integrity, and availability. The vendor has been notified but has not provided a patch or mitigation guidance. Public exploit code is available.

Successful exploitation allows remote attackers with high privileges to execute arbitrary operating system commands on the affected system. This can lead to unauthorized system control or data compromise depending on the commands executed. The impact on confidentiality, integrity, and availability is limited but non-negligible due to the OS command execution capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the affected component and apply network-level controls to limit exposure. Avoid exposing the vulnerable interface to untrusted networks.