PT-2026-21323 · Unknown · Getsimple Cms

Twinson333 · Published 2026-02-20 · Updated 2026-02-24 · CVE-2026-27146

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GetSimple CMS (affected versions not specified)

Description GetSimple CMS does not implement CSRF protection on the administrative file upload endpoint. An attacker can craft a malicious web page that silently triggers a file upload request from an authenticated victim’s browser. The request is accepted without requiring a CSRF token or origin validation, allowing an attacker to upload arbitrary files to the application without the victim’s knowledge or consent. To exploit this, the victim must be authenticated to GetSimple CMS and visit an attacker-controlled webpage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

CSRF

Weakness Enumeration

CWE-434

CWE-352

Related Identifiers

CVE-2026-27146

GHSA-26RV-8WPP-Q84R

Affected Products

Getsimple Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27146.json · Exploit
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-26rv-8wpp-q84r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27146 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27146 · Vendor Advisory
• https://twitter.com/CVEarity/status/2025175459907162290 · Twitter Post
• https://twitter.com/CVEnew/status/2024988690611904695 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025047496355971306 · Twitter Post
• https://t.me/cveNotify/152994 · Telegram Post
• https://t.me/cveNotify/152682 · Telegram Post
• https://t.me/CVEtracker/45330 · Telegram Post