CVE-2026-57518: Pagekit CMS privilege escalation leading to RCE
CVE-2026-57518 is verified against pagekit/pagekit · github affected versions: <= 1.0.18 fixed version: None available; project archived vulnerability class: RCE This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00256.
pruva-verify REPRO-2026-00256 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00256/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users to escalate privileges and execute remote code. Reproduce: deploy Pagekit 1.0.18, create a low-privileged authenticated user, exploit the privilege escalation to become admin, and then use the admin functionality to execute code.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.