CVE-2026-56660: GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GetSimple CMS CEto a version that resolves this vulnerability.Fixed in 1.5
Event History
Frequently Asked Questions
Which deployments are affected?
GetSimple CMS CE installations running versions earlier than 1.5 are affected. Version 1.5 contains the patch.
What access does an attacker need to achieve code execution?
The attacker must be able to cause the UpdateCE.php update handler to process a malicious ZIP archive. The resulting code executes as the web-server user because extracted PHP files are placed in a web-accessible directory.
What can a malicious archive do beyond placing PHP files in the web root?
Archive entry names can use directory-traversal sequences such as ../ to write files outside the intended extraction directory. This can allow files to be placed in other locations writable by the web-server user.