CVE-2025-48492 GetSimple CMS RCE in Edit component
Authenticated users with Edit component access can inject arbitrary PHP code to achieve remote code execution in GetSimple CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48492?
CVE-2025-48492 is a high-severity code injection vulnerability in GetSimpleCMS-CE, published on 30 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code Execution (RCE). This issue is set to be patched in version 3.3.22.
Weakness: CWE-77
Which versions are affected by CVE-2025-48492?
It affects 1 product.
Products include Getsimple-Ce Getsimple Cms.
How do I fix CVE-2025-48492?
No fix has been published for CVE-2025-48492 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-48492 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48492 exists.
Other vulnerabilities in GetSimpleCMS-CE
- CVE-2024-55085 Code injection in n/a
- CVE-2026-28495 GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php
- CVE-2026-27202 GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability
- CVE-2024-55088 Server-side request forgery in n/a
- CVE-2026-27161 Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories
Sources
Also known as GHSA-g435-p72m-p582.