Vulnerability · Published Oct 1, 2026 · Assigned by GitHub_M
CVE-2026-71426GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field
High 7.1
In plain English
A high-severity path traversal in GetSimpleCMS-CE from GetSimpleCMS-CE. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is passed unsanitized to a PHP include() when the page is rendered. Because the include path is never confined, this allows directory-traversal Local File Inclusion: arbitrary local files are included (and, if they contain PHP, executed) when any visitor requests the page. At time of publication, there are no publicly available patches.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GetSimpleCMS-CE | GetSimpleCMS-CE | <= 3.3.22 |
Weakness: CWE-22, CWE-98 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N