CVE-2026-56660 GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
Attackers can achieve remote code execution via unsafe ZIP extraction and path traversal in the update handler, allowing file writes outside the web root.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56660?
CVE-2026-56660 is a critical path traversal vulnerability in GetSimpleCMS-CE, published on 1 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.
Which versions are affected by CVE-2026-56660?
How do I fix CVE-2026-56660?
No fix has been published for CVE-2026-56660 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-56660 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56660 exists.