CVE-2026-56662
CriticalCVSS 9.6Summary
In GetSimple CMS CE prior to version 1.5, the UpdateCE update form lacked an anti-CSRF token and the POST handler did not verify token or request origin. A remote attacker can host a page that auto-submits a forged POST; when an authenticated admin visits it, the server performs an attacker-directed download-and-deploy operation, leading to remote code execution. The url field is also written unescaped, allowing HTML injection.
Risk Assessment
CSRF attack can lead to remote code execution on the server, potentially resulting in full compromise of the CMS.
Recommendation
Update GetSimple CMS CE to version 1.5 or later which includes the fix. Additionally, consider implementing extra CSRF protections.
Other vulnerabilities in GetSimple CMS CE
See all- CVE-2026-71542High
GetSimple CMS CE versions 3.3.22 and prior are vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context.
- CVE-2026-56661High
In GetSimple CMS CE prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.
- CVE-2026-56660Critical
In GetSimple CMS CE prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts it into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended directory.
Original NVD description (English source)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the server performs an attacker-directed download-and-deploy operation in the administrator's session — with no further interaction. Because the deployed content is executed (see the related ZIP-extraction advisory), this yields remote code execution. The url field is additionally written into the form unescaped, providing a secondary HTML-injection sink via a malicious upgrade.json. This issue has been patched in version 1.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS