GetSimple CMS EUVD-2026-76446

Exploitable when a GetSimple CMS (<=3.4.0a) or GetSimpleCMS-CE (<=3.3.22) instance has completed installation but admin/setup.php remains present because the flawed auto-deletion self-excluded that file - which is the default post-install state, not a misconfiguration the admin must introduce. The only real limiting factors are that the target must run an affected version and that setup.php must be reachable over the network; there is no authentication, user interaction, or special feature toggle required. Exploitation is prevented only where an operator has already manually removed setup.php or blocked access to the /admin/ path.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is credible for this flaw: exploitation is a single unauthenticated HTTP request to a leftover setup endpoint, with full impact once an admin account is created. The dangerous part is that this affects sites believed to be securely installed - the safety control that admins rely on silently fails, so the exposure is latent and default-configuration. No EPSS score, KEV listing, or public POC was provided, and there is no known patch, so scoring rests on the description and CVSS alone rather than observed exploitation; treat it as a high-priority, easy-to-weaponize issue that operators should remediate promptly rather than a confirmed mass-exploitation event. The chief mitigating factor is the product's small footprint, not any technical difficulty of attack.

An attacker scans for GetSimple CMS / GetSimpleCMS-CE sites and requests /admin/setup.php on a fully installed target; because the file was never deleted, the script accepts input and the attacker submits a new administrator username and password. They then log into /admin/ with the account they just created and take over content, upload code, or pivot into the hosting environment. No public exploit is documented, but the attack requires only a browser and the steps described in the advisory.