CVE-2026-56660
CriticalCVSS 9.1Summary
In GetSimple CMS CE prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts it into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended directory.
Risk Assessment
Remote code execution on the server can lead to full compromise of the CMS and its data.
Recommendation
Update GetSimple CMS CE to version 1.5 or later which includes the fix. Restrict archive processing to trusted sources only.
Other vulnerabilities in GetSimple CMS CE
See all- CVE-2026-71542High
GetSimple CMS CE versions 3.3.22 and prior are vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context.
- CVE-2026-56661High
In GetSimple CMS CE prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.
- CVE-2026-56662Critical
In GetSimple CMS CE prior to version 1.5, the UpdateCE update form lacked an anti-CSRF token and the POST handler did not verify token or request origin. A remote attacker can host a page that auto-submits a forged POST; when an authenticated admin visits it, the server performs an attacker-directed download-and-deploy operation, leading to remote code execution. The url field is also written unescaped, allowing HTML injection.
Original NVD description (English source)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS