CVE-2026-29014

CVE-2026-29014 is an unauthenticated PHP code injection flaw (CWE-94) in MetInfo CMS, caused by insufficient neutralization of user-supplied input in an execution path that evaluates PHP. A remote attacker needs no privileges or user interaction and triggers the flaw simply by sending crafted requests containing malicious PHP, which the server then executes. Successful exploitation results in full remote code execution, giving the attacker complete control over the affected web server and everything it hosts. All MetInfo CMS 7.9, 8.0, and 8.1 deployments are affected, with risk concentrated in internet-facing installations. Exploitation has been reported in the wild, public PoCs are available, and the 39.5% EPSS score (99th percentile) signals high near-term exploitation risk, though the flaw is not yet listed in CISA KEV.

What to do: Upgrade MetInfo CMS to the latest patched release; the advisory flags 7.9, 8.0, and 8.1 as affected, so confirm the exact fixed version in the vendor's advisory before upgrading, and prioritize internet-facing instances. Until patched, restrict or WAF-filter HTTP access to MetInfo endpoints and review access logs for crafted requests containing injected PHP syntax. Use the public PoC write-ups (Karmain Security KIS-2026-06 and WebSec) to identify the vulnerable request pattern when hunting for signs of compromise.