CVE-2021-46433: Fenom Project Fenom

Critical severity, CVSS 10.0. EPSS: 1.1% chance of exploitation in the next 30 days.

In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.

Affected products

• Fenom Project Fenom: up to and including 2.12.1

Published 2022-03-28. Last modified 2026-06-17.