CVE-2026-39169: High severity SEMCMS SEMCMS vulnerability
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMScopy.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SEMCMS_copy.phpfrom your environment.Remove or rename the SEMCMS_copy.php file from the webroot (or any publicly accessible location) if it is not required, to prevent unauthorized access to its functionality.
- Configuration
Block HTTP(S) access to SEMCMS_copy.php via the web server configuration (for example, restrict or deny requests to that filename using Apache/Nginx access rules) so the script cannot be executed by unauthorized users.
web server access to SEMCMS_copy.php = deny - Compensating control
If removing or patching SEMCMS_copy.php is not immediately possible, restrict access to the hosting system or management interfaces (e.g., firewall, network ACLs, WAF rules) so only trusted IPs or administrators can reach the affected endpoint.
- Operational
Audit server and application logs for any signs of unauthorized access involving SEMCMS_copy.php and investigate potential compromises. If any sensitive data or credentials may have been exposed, follow incident response procedures (including rotating affected credentials).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39169?
CVE-2026-39169 has a high severity rating of 7.5.
What impact does CVE-2026-39169 have?
CVE-2026-39169 allows unauthorized access, potentially compromising sensitive information.
How do I fix CVE-2026-39169?
To fix CVE-2026-39169, update to the latest version of SEMCMS that addresses this vulnerability.
Which software is affected by CVE-2026-39169?
CVE-2026-39169 affects SEMCMS version 5.0.
When was CVE-2026-39169 published?
CVE-2026-39169 was published on June 9, 2026.