CVE-2026-71426: GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is passed unsanitized to a PHP include() when the page is rendered. Because the include path is never confined, this allows directory-traversal Local File Inclusion: arbitrary local files are included (and, if they contain PHP, executed) when any visitor requests the page. At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with page-editing rights can set an arbitrary filesystem path in a page's template attribute. Exploitation is triggered when any visitor requests the affected page on the public front end.
What is the impact once a malicious template path is saved?
The application includes the referenced local file without confining the path, enabling directory-traversal local file inclusion. Included files containing PHP may be executed when the page is rendered.
Are patched versions available?
No publicly available patches were available at the time of publication. The affected versions are 3.3.22 and earlier.