← Vulnerability feed

Vulnerability record · CVE-2026-27161 · published 21 February 2026

CVE-2026-27161: Getsimple-ce getsimple cms information exposure vulnerability

GGetsimple Ce · Getsimple Cms

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.

8.7 CVSS 4.0 High EPSS 0.47% · top 62.2% CWE-200 · Information exposure
8.7CVSS 4.0 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-f63g-xh6j-q56g ExploitMitigationVendor Advisory

Track CVE-2026-27161 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-55085Getsimple-ce getsimple cms code injection vulnerabilityGetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used…EPSS 0.86%8.8CVE-2026-28495Getsimple-ce getsimple cms cross-site request forgery vulnerabilityGetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administr…EPSS 0.32%8.8CVE-2026-27202Getsimple-ce getsimple cms path traversal vulnerabilityGetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file …EPSS 0.54%8.8CVE-2024-55088Getsimple-ce getsimple cms cross-site request forgery vulnerabilityGetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.EPSS 0.25%8.6CVE-2025-48492Getsimple-ce getsimple cms command injection vulnerabilityGetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can…EPSS 0.91%7.2CVE-2024-55086Getsimple-ce getsimple cms server-side request forgery (ssrf) vulnerabilityIn the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend man…EPSS 0.42%7.1CVE-2026-27146Getsimple-ce getsimple cms cross-site request forgery vulnerabilityGetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoi…EPSS 0.17%6.9CVE-2026-27147Getsimple-ce getsimple cms cross-site scripting vulnerabilityGetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can u…EPSS 0.25%

Source: NIST National Vulnerability Database (record CVE-2026-27161), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.