CVE-2023-46818

ISPConfig before 3.2.11p1 allows PHP code injection through its language file editor, but two conditions frame it precisely: the actor must be an administrator, and the admin_allow_langedit option has to be enabled. When both hold, an admin can inject PHP that the server executes — code execution on the hosting control panel, which is a powerful position. But the bug is gated by admin privilege and a specific configuration toggle.

That gating is why we rank it below the unauthenticated RCEs it superficially resembles. The realistic threat model is an admin whose credentials were compromised, or a multi-admin panel where not every administrator is fully trusted; it is not something an anonymous internet scanner turns into a shell. The language-editor feature has to be switched on for the path to exist at all, which narrows the exposed population further.

Our practical move is configuration triage rather than a blanket patch scramble: find ISPConfig instances below 3.2.11p1 and check whether admin_allow_langedit is actually enabled, because instances with it off aren't reachable through this path. Where it's on, we prioritize the upgrade and, in the meantime, disabling the setting is a clean interim mitigation that closes the door without waiting.