GetSimple CMS EUVD-2026-91020

Requires an authenticated account with page-editing rights (PR:L) - this is the primary limiting factor, since an anonymous visitor cannot set the malicious path. The exploitable feature is the page 'template' attribute, which is stored and then passed directly to a PHP include() on the public front-end with no path confinement, so default configurations are vulnerable with no special settings needed. No user interaction by a privileged party is required to trigger execution: any visitor (including an unauthenticated one) requesting the poisoned page fires the include(). Successful PHP execution additionally requires that the included file contain PHP (e.g., a system log, uploaded file, or attacker-controlled file the attacker can plant); pure file disclosure works against any readable local path.

This is a genuine but conditional risk, not a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low-privilege authentication, scored 7.1. SSVC reinforces a moderate priority: Exploitation=poc (proof-of-concept exists, not active exploitation), Automatable=no (an attacker must first obtain page-editing credentials, so mass automated scanning is impractical), and Technical Impact=partial. There is no EPSS score and no CISA KEV listing in the input, so there is no evidence of widespread or confirmed in-the-wild abuse - consistent with Automatable=no pointing to targeted rather than opportunistic use. The most important conflict: the input CVSS 4.0 vector rates only integrity (VI:H) with VC:N and VA:N, yet the description is a Local File Inclusion that both reads arbitrary local files (a confidentiality impact) and executes included PHP (a full code-execution impact affecting integrity and availability). The vendor vector therefore appears to understate real impact - verify against the GHSA advisory. The aggravating factor is that no patch exists at publication, leaving mitigation to access control and WAF/input restrictions only.

An attacker who holds (or phishes/brute-forces) an account with page-editing rights edits a page and sets its template attribute to a directory-traversal path such as ../../../../etc/passwd or a path to an attacker-planted PHP file. When any ordinary visitor subsequently loads that page, the front-end passes the value unsanitized to PHP include(), disclosing the local file or executing its PHP as the web server. Proof-of-concept exploitation is indicated by the SSVC 'poc' status.