All vulnerabilities
CVE-2026-56661GHSA-r7v8-mx29-5q8h

GetSimpleCMS-CE: GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint

GetSimpleCMS-CE GetSimpleCMS-CE
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.5Fixed versionGitHub
Published1 Oct 2026Updated 1 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.

Text from CVE List

Affected versions 2

  • GetSimpleCMS-CEaffected: < 1.5CVE List
  • UpdateCE, php<= 1.4GitHub

References 1