CVE-2021-47736 CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing
Administrative users can upload malicious PHP files via content editing to achieve arbitrary command execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47736?
CVE-2021-47736 is a high-severity code injection vulnerability in Cmsimple-Xh CMSimple_XH, published on 23 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitrary command execution on the server.
Weakness: CWE-94
Which versions are affected by CVE-2021-47736?
It affects 1 product.
Products include Cmsimple-Xh Cmsimple Xh.
How do I fix CVE-2021-47736?
No fix has been published for CVE-2021-47736 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-47736 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47736 exists.
Other vulnerabilities in Cmsimple-Xh CMSimple_XH
Sources
Also known as GHSA-353h-pmfp-h8fp.