CVE-2026-56661 GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
An attacker can exploit a Server-Side Request Forgery vulnerability in GetSimple CMS to read internal network resources and cloud metadata via the update endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-56661?
CVE-2026-56661 is a high-severity server-side request forgery vulnerability in GetSimpleCMS-CE, published on 1 Oct 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.
Weakness: CWE-918
Which versions are affected by CVE-2026-56661?
How do I fix CVE-2026-56661?
No fix has been published for CVE-2026-56661 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-56661 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56661 exists.