Cms Made Simple CVE-2026-5203

While the CVSS 4.0 score of 5.1 appears moderate, several factors contextualize real-world risk. The attack vector is network-accessible (AV:N) and requires low complexity (AC:L), but critically demands high privileges (PR:H), restricting the attacker pool to administrators or high-privilege users. EPSS data is not provided, but the presence of publicly available exploit code combined with vendor confirmation of the issue increases demonstration feasibility. The limited scope (SC:N) and modest impact (confidentiality, integrity, and availability all rated L) suggest this is not a critical remote code execution path; rather, it enables localized file manipulation. The CVSS vector includes E:P (Exploit: Proof of Concept), confirming public exploit availability. SSVC assessment: exploitation is demonstrated (POC exists), likely automatable for privileged users, with technical impact constrained to file placement rather than system compromise. Real-world priority is moderate-this is a valid privilege-escalation or lateral-movement vector for authenticated attackers but not a primary attack vector for initial compromise. Organizations should prioritize this below unauthenticated RCE vulnerabilities but address it as part of routine patching cycles, especially if admin account compromise is a threat model.

An administrator account is compromised or a malicious insider with high-privilege CMS access uploads a specially crafted XML file via the UserGuide Module import feature. The XML payload includes path traversal sequences in file references that cause _copyFilesToFolder to write files outside the intended UserGuide directory-for example, writing a PHP webshell to the web root or overwriting configuration files. Because the attacker holds high privileges and the import process runs server-side, the malicious file placement succeeds, potentially allowing further post-exploitation. Publicly available exploit code simplifies proof-of-concept demonstration of this attack chain.