GetSimple CMS CE EUVD-2026-91018

Exploitation requires (1) a GetSimple CMS CE instance prior to version 1.5, and (2) an administrator with an active authenticated admin session to visit an attacker-controlled page while logged in - the UpdateCE update form ships with no anti-CSRF token and the POST handler performs no token or request-origin verification, so the forged update POST executes in the admin's session with no further interaction. Limiting factors that reduce real-world risk: the attacker cannot act without a logged-in admin being lured to the malicious page (UI:R), exploitation is confined to versions < 1.5, and the secondary HTML-injection sink (unescaped url field) additionally depends on a malicious upgrade.json being fetched. This is not a server-only, zero-interaction remote exploit despite PR:N.

This is a genuinely high-severity issue, not merely a high-CVSS-but-low-real-risk case, but its exploitation is gated by a social-engineering precondition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) correctly captures a CSRF chain: the attacker themselves needs no credentials (PR:N), the attack is network-delivered with low complexity, but it is NOT a drive-by against the server - UI:R reflects that a logged-in administrator must visit the attacker's page. The CWE-352 (CSRF) root cause combined with the referenced ZIP-extraction/download-and-deploy behavior credibly yields RCE, justifying C:H/I:H/A:H. No EPSS score was provided, and there is no CISA KEV listing and no POC flag in the input, so exploitation status is 'no public exploit identified at time of analysis' - the 9.6 is a severity ceiling, not evidence of in-the-wild activity. SSVC-style reasoning: technical impact is total, but the attack is NOT automatable in the SSVC sense because it depends on luring/waiting for an authenticated admin to visit a malicious page, pushing real-world urgency below what the raw score implies. The product's narrow deployment footprint further tempers aggregate risk. No conflicting signals in the core data, but several signals (EPSS, POC, KEV) are simply absent rather than contradictory.

An attacker hosts a web page that auto-submits a forged POST to the GetSimple CMS CE UpdateCE endpoint, pointing the update at an attacker-controlled upgrade.json/package. They lure a logged-in administrator (e.g., via phishing link) to the page; the admin's browser silently submits the request, the server downloads and deploys attacker content, and the extracted content is executed, giving remote code execution. No public exploit is identified at time of analysis, though the mechanics are documented in the vendor advisory and the attack is low-complexity once an admin is lured.