CVE-2026-36453

Rhymix, an open-source PHP content management system, fails to properly validate requests involving extra variables (extra_vars) in versions before 2.1.31, resulting in an insecure direct object reference (CWE-425, tracked by the project as RVE-2026-1). A low-privileged, authenticated user can manipulate these variable references to access files outside the intended scope of the application, such as server configuration files or other documents stored on the host. Successful exploitation can expose sensitive data (e.g., credentials in config files) and, given the CVSS impact ratings, potentially allow file modification or deletion as well, affecting resources beyond the CMS itself (scope changed). Any site or service running Rhymix older than 2.1.31 is affected, and exploitation requires only a basic member-level account on the target site. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Upgrade Rhymix to version 2.1.31 or later immediately. Review web server and application logs for authenticated member accounts issuing unusual requests involving extra variables that resolved to file paths outside expected upload/document directories. Because arbitrary file reads can expose secrets, rotate database credentials and API keys stored in files such as config files if any suspicious access is found, and consider tightening member registration or permissions to reduce the pool of low-privileged accounts.