CVE-2020-37137 is a code injection flaw in PHP-Fusion 9.03.50, scored 6.1 (medium) by CVSS 3.1. The add_panel_form() function passes posted panel content to eval() without cleaning it. The record names no fixed version, so upgrade to the current PHP-Fusion release and review existing panels.
What's affected
The record lists PHP-Fusion 9.03.50. The function involved is add_panel_form(), reached through the panels.php administration endpoint, and the field is the panel_content POST parameter.
The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C, with low confidentiality and integrity impact. User interaction is required, which fits an attack that depends on an administrator being tricked into submitting a form. The record does not name a fixed version, so check the project site and release notes.
How to check if you're exposed
PHP-Fusion is a self hosted PHP CMS, so check the install directly.
- Find the version in the administration dashboard, or in the version constant in the installed files.
- If it reads 9.03.50, you are in scope. The record does not cover other versions, so check the project advisories for them.
- Review the list of panels in the admin area for entries you did not create, especially any that contain PHP code.
- Check web server logs for POST requests to the panels administration page from unexpected sources.
What to do now
- Back up the site files and database.
- Upgrade PHP-Fusion to the newest release from the project and read its change notes for this issue.
- Review all existing panels, and delete any with content you do not recognize.
- Limit the admin area to trusted addresses and make administrators use a separate browser profile for admin work.
- Rotate administrator passwords if you find anything unexpected.
Why it matters
The weakness is CWE-94, improper control of generated code, together with CWE-95, eval injection. The application takes text from a request and runs it as code. Anything the sender writes becomes code on the server, with the rights of the web process.
The score is only medium because the record describes a request that needs user interaction, but the effect of running code is still serious. Admin forms that call eval() are a design smell. Storing panel content as data and rendering it through a template removes the need to evaluate it at all.
Quick check
Why is the score only 6.1?
The vector requires user interaction, and the record lists low confidentiality and integrity impact. The class of weakness, running posted text as code, is still one to fix quickly.
Sources
Last reviewed: 19 October 2026.
