CVE-2021-47734 CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution
Authenticated attackers can execute arbitrary code by manipulating PHP session files and uploading malicious code in CMSimple.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47734?
CVE-2021-47734 is a high-severity vulnerability in CMSimple, published on 23 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.
Weakness: CWE-98
Which versions are affected by CVE-2021-47734?
It affects 1 product.
Products include Cmsimple Cmsimple.
How do I fix CVE-2021-47734?
No fix has been published for CVE-2021-47734 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-47734 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47734 exists.
Other vulnerabilities in CMSimple
Sources
Also known as GHSA-62fv-j8g5-r47m.