Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M

CVE-2026-28495GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php

Critical 9.7

In plain English

A critical-severity cross-site request forgery in GetSimpleCMS-CE from GetSimpleCMS-CE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)9.7Critical

Exploit odds (30 days)0.4%top 71.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in admin, achieving Remote Code Execution (RCE) on the web server.

Affected products (as reported)

Vendor	Product	Versions
GetSimpleCMS-CE	GetSimpleCMS-CE	<= 3.3.22

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-92wv-q2jp-qg88 x_refsource_CONFIRM