Vulnerability · Published Mar 31, 2026 · Assigned by VulDB
CVE-2026-5203CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
Medium 4.7
In plain English
A medium-severity path traversal in CMS Made Simple. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This issue has been reported early to the project. They confirmed, that "this has already been discovered and fixed for the next release."
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | CMS Made Simple | 2.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.7 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-354331 | CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal vdb-entry, technical-description
- VDB-354331 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #772855 | CMSMadeSimple CMS Made Simple (CMSMS) 2.2.22 and old versions modules/UserGuide/lib/class.UserGuideImporterExporter.php third-party-advisory
- https://drive.proton.me/urls/Q0JHZ339BW#X9P2G3Guwvwa exploit