by Kastro
Paper/Archive/CVE-2026-28495

CVE-2026-28495

GetSimpleCMS-CE GetSimpleCMS-CE — GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php

EPSS 0.3%CVSS 9.7
critical.is priorityof 100
34
CVSS 9.7 (CNA)9.7 / 10 × 3029.1Not in CISA KEV+300.0EPSS percentile 24.3.243 × 204.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in admin, achieving Remote Code Execution (RCE) on the web server.

Affected

ProductAffectedFixed inSource
GetSimpleCMS-CE<= 3.3.22–CNA

Scores by source

GitHub_M (CNA)9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-92wv-q2jp-qg88