CVE-2026-5203: CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This issue has been reported early to the project. They confirmed, that "this has already been discovered and fixed for the next release."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5203?
The severity of CVE-2026-5203 is classified as high due to its potential for path traversal attacks allowing unauthorized file access.
How do I fix CVE-2026-5203?
To fix CVE-2026-5203, update CMS Made Simple to version 2.2.23 or later to mitigate the vulnerability.
What versions of CMS Made Simple are affected by CVE-2026-5203?
CVE-2026-5203 affects CMS Made Simple versions up to and including 2.2.22.
What impact does CVE-2026-5203 have on my website?
CVE-2026-5203 can lead to unauthorized access to files on your server, posing a risk to sensitive data.
Where is the CVE-2026-5203 vulnerability located in the CMS Made Simple code?
The CVE-2026-5203 vulnerability is found in the _copyFilesToFolder function within the modules/UserGuide/lib/class.UserGuideImporterExporter.php file.