What is the CVSS score of CVE-2026-27161?

CVE-2026-27161 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-27161?

Yes, a public proof-of-concept exploit is available for CVE-2026-27161. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27161?

Within 24 hours: identify all GetSimple CMS instances in your environment and document their exposure level (internet-facing vs. internal). Within 7 days: implement compensating controls (WAF rules, network access restrictions, directory hardening) and disable GetSimple CMS if not business-critical. Within 30 days: evaluate migration to alternative CMS platforms or establish a patching timeline with the vendor, and conduct a forensic review of access logs for signs of exploitation.

Getsimple Cms CVE-2026-27161

HIGH

Information Exposure (CWE-200)

2026-02-21 security-advisories@github.com

Apache Getsimple Cms Getsimple Ce

7.5

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Discover Apache AllowOverride disabled
Exploit

Access /data/ directory via HTTP
Execution

Download authorization.xml file
Impact

Extract cryptographic salts and API keys

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Apache AllowOverride directive set to 'None' or 'Off' in server configuration, disabling .htaccess-based access controls on GetSimple CMS directories. No authentication required; exploitation occurs against default GetSimple installations on misconfigured Apache servers.
Impact	CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. Public exploit/POC available.
Exploit ScenarioDerived	An attacker without authentication could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Unauthenticated attackers can access sensitive files in GetSimple CMS when Apache's AllowOverride directive is disabled, bypassing .htaccess protections that restrict directory access. This configuration is common in hardened and shared hosting environments, exposing authorization credentials, API keys, and cryptographic salts in files like authorization.xml. Public exploit code exists for this vulnerability, and no patch is currently available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:04 CVSS 7.5

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. [CVSS 7.5 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-200 (Information Exposure). Affects Getsimple Cms. GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of p

Know when Getsimple Cms gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Feb 24, 2026 - 13:10 vuln.today

Public exploit code

CVE Published

Feb 21, 2026 - 00:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.

Executive ViewAI

Why It Matters

GetSimple CMS installations are vulnerable to unauthorized access of sensitive directories containing backup files and database information due to reliance on .htaccess protection mechanisms that can be bypassed. Organizations running GetSimple CMS face potential data exposure and operational disruption if attackers gain access to backups and configuration data; this risk is elevated due to publicly available exploit code.

Business Impact: High

Compensating Controls

Implement Web Application Firewall (WAF) rules to block direct access to /data/ and /backups/ directories; move sensitive directories outside the web root; restrict network access to GetSimple CMS via firewall/VPN; disable directory listing via web server configuration; implement strong authentication and IP whitelisting; disable GetSimple CMS entirely if not actively used; monitor access logs for suspicious requests to sensitive paths.

Threat Intelligence Overview

EPSS Score

0.1%

Top 80% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:getsimple-ce:getsimple_cms:*:*:*:*:community:*:*:*

More in Getsimple Cms

View all

CVE-2014-8722 HIGH Act Now POC

7.5 Mar 17

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<user

CVE-2019-11231 CRITICAL Emergency POC

9.8 May 22

An issue was discovered in GetSimple CMS through 3.3.15. Rated critical severity (CVSS 9.8), this vulnerability is remot

CVE-2022-41544 CRITICAL Act Now POC

9.8 Oct 18

GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramete

CVE-2026-28495 CRITICAL Act Now POC

9.6 Mar 10

GetSimple CMS massiveAdmin plugin has a CSRF vulnerability enabling attackers to perform admin actions through crafted m

CVE-2018-17103 HIGH This Week POC

8.8 Sep 16

An issue was discovered in GetSimple CMS v3.3.13. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit

CVE-2026-27202 HIGH This Week POC

7.5 Feb 21

Arbitrary file read vulnerability in GetSimple CMS affects all versions through its Uploaded Files feature, allowing una

CVE-2020-23839 MEDIUM This Month POC

6.1 Sep 01

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpa

CVE-2018-16325 MEDIUM This Month POC

6.1 Sep 01

There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field. Rated medium severity (CVSS 6.1), this vulnera

CVE-2018-9173 MEDIUM This Month POC

6.1 Apr 02

Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows rem

CVE-2024-55085 CRITICAL Act Now

9.8 Dec 16

GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background managem

CVE-2026-27147 MEDIUM This Month POC

5.4 Feb 21

GetSimple CMS allows authenticated users to upload SVG files containing malicious JavaScript through the administrative

CVE-2022-1503 MEDIUM This Month POC

5.4 Apr 27

A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Rated medium severity (CVSS 5.4),

Same weakness CWE-200 – Information Exposure

View all

CVE-2024-24919 HIGH POC

8.6

CVE-2021-41277 HIGH POC

7.5

CVE-2016-6415 HIGH POC

7.5

CVE-2013-7331 MEDIUM POC

6.5

CVE-2025-31125 MEDIUM POC

5.3

CVE-2025-11749 CRITICAL POC

9.8

CVE-2017-16894 HIGH POC

7.5

CVE-2017-11165 CRITICAL POC

9.8

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back