GetSimple CMS CE EUVD-2026-91017

Exploitation requires an authenticated account with access to the GetSimple CMS CE update handler form (CVSS PR:H indicates high/administrative privileges), and the installed version must be prior to 1.5. The specific vulnerable mechanism: the update handler passes a user-supplied URL to file_get_contents() after only FILTER_VALIDATE_URL format validation with no destination/scheme/IP allowlisting, and the fetched body is written to the web-accessible path /Tmpfile.zip and left in place even when it is not a valid ZIP. LIMITING FACTORS that reduce real-world risk: it is NOT unauthenticated (admin-level form access is needed), so it is primarily an insider or post-credential-compromise vector; full read-back depends on the server being able to reach the targeted internal/metadata endpoint (e.g. 169.254.169.254 only yields credentials in cloud environments that expose an unauthenticated metadata service). No special non-default configuration is otherwise required.

This is a full-read Server-Side Request Forgery (CWE-918) in GetSimple CMS CE's update handler, and the signals are moderately - not critically - alarming. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L, base 7.5) reflects network-reachable, low-complexity exploitation, but critically requires PR:H - high privileges, i.e. an authenticated administrator who can reach the update form. This authentication barrier substantially lowers real-world mass-exploitation risk. CISA's SSVC framing aligns: Exploitation=poc (not active), Automatable=no, Technical Impact=partial. No CISA KEV listing and no EPSS score were provided, so there is no evidence of active or widespread exploitation. The signals are therefore internally consistent and point to a genuine but bounded issue: a privileged insider or an attacker who has already compromised an admin session can pivot to internal services and cloud metadata (169.254.169.254) to harvest credentials, but this is not a drive-by, unauthenticated internet-wide threat. One point to verify: the input vector carries UI:R, yet the described action (the authenticated user submitting the update form themselves) does not obviously require separate victim interaction - this UI:R may be conservative or an artifact; confirm with the vendor advisory. Overall priority: medium - elevate only for internet-exposed GetSimple CE instances where admin credentials or sessions may be weakly protected.

An authenticated administrator (or an attacker who has hijacked an admin session) submits the update handler form with a URL pointing at an internal-only service or the cloud metadata endpoint (http://169.254.169.254/...). The server fetches that URL via file_get_contents() after only FILTER_VALIDATE_URL format checks, writes the response body to the web-accessible /Tmpfile.zip, and - because the file is not deleted when the content is not a valid ZIP - the attacker simply downloads /Tmpfile.zip to read the internal response, exfiltrating metadata credentials or internal service data. Publicly available exploit code exists (SSVC Exploitation=poc).