CVE-2026-29014

This vulnerability is like a “back door” in your website software: someone on the internet can send a specially made request that makes your server run attacker-supplied PHP code. That can let them fully control the server, not just the website page they visited.

Think of it like leaving the key under the doormat—anyone who finds it can walk in and do whatever they want with the building.

This matters if you run MetInfo CMS (Metinfo/MetInfo CMS) and your installation is one of the affected versions (7.9, 8.0, or 8.1). The key risk is that the flaw can be triggered remotely without any login or user interaction.

It is a risk when the vulnerable MetInfo CMS can be reached from the internet (directly or through your public network exposure).

This is RED because the weakness allows remote attackers to execute arbitrary PHP code without authentication, which is consistent with serious, full-compromise outcomes. There is also sustained press attention indicating ongoing scrutiny around exploitation patterns.

Act now: treat any MetInfo CMS instance on versions 7.9–8.1 as exposed until you confirm patching/remediation.