GetSimple CMS CE EUVD-2026-91016

Exploitation requires the UpdateCE.php update handler in GetSimple CMS CE prior to 1.5 to process an attacker-controlled ZIP archive, which the extraction routine writes into the web-accessible root without validating file type or extraction path (enabling PHP webshell drop and ../ directory traversal). The limiting factors are significant: per the CWE-352/CSRF classification the attack hinges on an authenticated administrator being tricked into triggering the update (user interaction plus an existing admin session), and per the supplied CVSS vector it alternatively requires high existing privileges; SSVC marks it not automatable, so it cannot be mass-exploited by unauthenticated scanning. Only versions below 1.5 are affected; 1.5 contains the fix.

This is a genuine high-severity issue but with meaningful real-world constraints. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) describes a scope-changing remote code execution, and SSVC reports Technical Impact: total - consistent with arbitrary PHP execution as the web-server user. However, there is a notable internal conflict: the CWE is CWE-352 (Cross-Site Request Forgery) and 'CSRF' appears in the tags, yet the CVSS vector lists PR:H and UI:N - CSRF exploitation normally implies PR:N with UI:R (an unauthenticated attacker tricking an authenticated admin), not high privileges with no interaction. This discrepancy should be verified with the vendor advisory, as it changes who can realistically exploit it. SSVC marks Exploitation: poc (proof-of-concept exists) and Automatable: no, meaning this is not a wormable, mass-scannable flaw - exploitation is targeted and requires either admin-level access or social-engineering an administrator. No EPSS score and no CISA KEV listing were provided, and there is no evidence of active exploitation. Net: a legitimate priority for any GetSimple CMS CE operator because the impact is total RCE, but the 'not automatable' nature, the privilege/interaction gating, and the niche deployment footprint place it below internet-wide emergencies like unauthenticated-no-interaction RCEs.

An attacker crafts a malicious ZIP archive containing a PHP webshell (optionally using ../ path-traversal entry names) and causes the UpdateCE.php update handler to process it - plausibly by luring an authenticated administrator to a page that forges the update request (CSRF). The handler extracts the PHP file into the web-accessible root, and the attacker then requests the planted file to execute arbitrary code as the web-server user. Proof-of-concept exploitation is indicated (SSVC Exploitation: poc).