CVE-2026-27161: Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories
GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27161?
CVE-2026-27161 has been classified as a medium severity vulnerability due to its potential for information disclosure.
How does CVE-2026-27161 work?
CVE-2026-27161 allows unauthenticated access to sensitive directories if .htaccess restrictions are bypassed in GetSimple CMS.
How do I fix CVE-2026-27161?
To fix CVE-2026-27161, ensure that Apache AllowOverride is enabled to utilize .htaccess files correctly in GetSimple CMS.
What versions of GetSimple CMS are affected by CVE-2026-27161?
All versions of GetSimple CMS are affected by CVE-2026-27161.
Is there a workaround for CVE-2026-27161?
Yes, manually securing access to sensitive directories and correctly configuring server permissions can serve as a temporary workaround for CVE-2026-27161.