PT-2026-21323 · Unknown · Getsimple Cms

Twinson333 · Publicado 2026-02-20 · Atualizado 2026-02-24 · CVE-2026-27146

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GetSimple CMS (affected versions not specified)

Description GetSimple CMS does not implement CSRF protection on the administrative file upload endpoint. An attacker can craft a malicious web page that silently triggers a file upload request from an authenticated victim’s browser. The request is accepted without requiring a CSRF token or origin validation, allowing an attacker to upload arbitrary files to the application without the victim’s knowledge or consent. To exploit this, the victim must be authenticated to GetSimple CMS and visit an attacker-controlled webpage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

CSRF

Enumeração de Fraquezas

CWE-434

CWE-352

Identificadores relacionados

CVE-2026-27146

GHSA-26RV-8WPP-Q84R

Produtos afetados

Getsimple Cms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27146.json · Exploit
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-26rv-8wpp-q84r · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2025175459907162290 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2024988690611904695 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2025047496355971306 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27146 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27146 · Aviso do Fabricante
• https://t.me/cveNotify/152994 · Publicação no Telegram
• https://t.me/cveNotify/152682 · Publicação no Telegram
• https://t.me/CVEtracker/45330 · Publicação no Telegram