CVE-2026-29014

This vulnerability is like a “back door” in your website software: someone on the internet can send a specially made request that makes your server run attacker-supplied PHP code. That can let them fully control the server, not just the website page they visited.

Think of it like leaving the key under the doormat—anyone who finds it can walk in and do whatever they want with the building.

This matters if you run MetInfo CMS (Metinfo/MetInfo CMS) and your installation is one of the affected versions (7.9, 8.0, or 8.1). The key risk is that the flaw can be triggered remotely without any login or user interaction.

It is a risk when the vulnerable MetInfo CMS can be reached from the internet (directly or through your public network exposure).

This is RED because the weakness allows remote attackers to execute arbitrary PHP code without authentication, which is consistent with serious, full-compromise outcomes. There is also sustained press attention indicating ongoing scrutiny around exploitation patterns.

Act now: treat any MetInfo CMS instance on versions 7.9–8.1 as exposed until you confirm patching/remediation.

Step 1 — Confirm exposure

• Identify the exact MetInfo CMS version you run (confirm whether it is 7.9, 8.0, or 8.1).
• Confirm how your CMS is reachable (e.g., public URL accessible from the internet, reverse proxy/WAF in front, etc.).

Step 2 — Remediate (vendor guidance)

• Apply the remediation steps provided by MetInfo in their notice for this issue: https://www.metinfo.cn/news/2875.html
• Upgrade MetInfo CMS to the patched version as instructed by the vendor (the correct fixed version is determined by MetInfo’s published guidance, since it’s not specified in the findings you provided).

Step 3 — If you can’t patch immediately

• Reduce exposure by blocking internet access to the MetInfo CMS instance until remediation is complete (network-level restriction in front of the server).
• Watch for unusual request patterns in web server access logs around CMS endpoints (especially requests that look like attempts to inject or execute code).

Step 4 — After upgrade

• Re-verify the MetInfo CMS version is no longer one of 7.9–8.1.
• Continue log review for a period of time to ensure there are no ongoing probing attempts.

KEV / timeline notes

• This CVE is not listed in CISA KEV based on the provided findings, and no clear dated exploitation claim is included there—however, the traffic is considered urgent due to the unauthenticated code execution capability described in the findings.

CVE-2026-29014 (CWE-94) affects Metinfo/MetInfo CMS and is classified as critical: it enables an attacker to inject and execute arbitrary PHP code on the server using crafted remote requests without authentication or user interaction. The impact can reach full system compromise (confidentiality, integrity, and availability are at high risk per the overall assessment).

Exploitation status: KEV is not listed in the findings, and no specific dated press claim or public exploit code was provided. However, the findings indicate sustained press attention and that the vulnerability can be triggered remotely without login—this combination is treated as RED in the overall verdict.

EPSS is provided as a prediction in the findings (and should not be treated as proof of exploitation). KEV (if present) would override prediction, but it is not present here based on the provided data.

Attack mechanism (high level): insufficient input neutralization in the vulnerable execution path allows remote code execution by injecting PHP code into crafted requests.