Pagekit

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.

Published: 2026-06-26T15:58:20.847Z
Updated: 2026-07-14T21:34:31.734Z

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-04-25T15:15:17.497Z
Updated: 2026-04-27T13:42:31.371Z

pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.

Published: 2022-04-01T13:22:47.000Z
Updated: 2024-08-04T04:17:23.473Z

Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.

Published: 2018-07-18T15:00:00.000Z
Updated: 2024-08-05T09:29:50.129Z

Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/poc.svg" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.

Published: 2018-06-01T21:00:00.000Z
Updated: 2024-08-05T08:10:14.600Z