This vulnerability in mtrano APENCMS up to commit 6546096d354153309693efabb9a0d824628ed4f5 involves the eval function in cms/weasel.php within the Template Engine component. An attacker can manipulate the $_CMS['site'] argument to inject and execute arbitrary code remotely. The product's rolling release model means no explicit versioning information is available for affected or patched releases. The vendor was contacted but did not provide any response or advisory. Public exploit code exists, increasing the risk of potential exploitation.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system with high privileges, potentially compromising the integrity and confidentiality of the CMS environment. The CVSS 4.0 base score is 4.8 (medium), reflecting network attack vector, low complexity, no privileges required for attack initiation, but requiring high privileges and partial user interaction. The impact on confidentiality, integrity, and availability is low to limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is disclosed, users should monitor for updates from the vendor or community. Until a fix is available, avoid exposing the vulnerable component to untrusted networks or inputs that can manipulate $_CMS['site'].