Zero Radar
← feed
CriticalVulnerabilityCVE-2026-110355updated 25 Oct 2026, 13:32 UTC

Imperia CMS SiteActive template flaw allows unauthenticated remote code execution

Attackers without any login can send specially crafted input to the website's template system and run their own commands on the server. That can let them take over the site and what it stores.

1 source, unconfirmed
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1AttackerNo login or account needed
  2. 2Crafted requestMalicious template input sent to site
  3. 3Template engineInput is evaluated as template code
  4. 4Code runsAttacker commands execute on server
  5. ResultAttacker controls the server

What happened

A server-side template injection (SSTI) flaw in the SiteActive template component of Imperia CMS allows unauthenticated remote code execution.

Why it is dangerous: Successful exploitation gives an attacker control of the underlying server, putting site data and any connected systems at risk. Organizations running public Imperia CMS sites are exposed.

Are you affected?

You are affected if you run Imperia CMS with the SiteActive template component exposed to the internet.

Imperia CMS with the SiteActive TEMPLATE component (versions unknown)

What to do

  1. Check whether your Imperia CMS installation uses the SiteActive template component
  2. Restrict access to affected sites or disable the SiteActive template until a fix is confirmed
  3. Watch the vendor's official channels for a patched version and apply it as soon as it is released

Timeline

  1. 23 Oct 2026, 14:37 UTC
    Publicly disclosed
  2. 23 Oct 2026, 14:37 UTC
    Reported by r/netsec · r/netsec

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
CVE-2026-110355
Disclosed
23 Oct 2026, 14:37 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Imperia CMS SiteActive template flaw allows unauthenticated remote code execution · Zero Radar