CVE-2026-56662: GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the server performs an attacker-directed download-and-deploy operation in the administrator's session — with no further interaction. Because the deployed content is executed (see the related ZIP-extraction advisory), this yields remote code execution. The url field is additionally written into the form unescaped, providing a secondary HTML-injection sink via a malicious upgrade.json. This issue has been patched in version 1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GetSimple CMS CEto a version that resolves this vulnerability.Fixed in 1.5
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Instances running a version prior to 1.5 are exposed if an administrator can be induced to visit an attacker-controlled page while authenticated to the CMS. The attack is remote and requires no attacker privileges, but it does require administrator interaction.
What does the attacker need to do to achieve code execution?
The attacker hosts a page that automatically submits a forged POST request to the update endpoint. When an authenticated administrator visits that page, the application performs an attacker-directed download and deployment operation in the administrator's session, and the deployed content can be executed.
What is the remediation?
Upgrade GetSimple CMS CE to version 1.5, which patches the issue. The provided information does not identify a workaround for systems that cannot be upgraded immediately.
Is there an additional impact beyond the forged update request?
Yes. A malicious upgrade.json can supply a URL value that is written back into the update form without escaping, creating a secondary HTML-injection sink.