PT-2026-21325 · Apache+1 · Apache+1

Twinson333 · Published 2026-02-20 · Updated 2026-02-24 · CVE-2026-27161

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GetSimple CMS (affected versions not specified)

Description GetSimple CMS is a content management system. All versions of GetSimple CMS depend on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled, a common configuration in hardened or shared hosting environments, these protections are silently ignored. This allows unauthenticated attackers to list and download sensitive files, including authorization.xml, which contains cryptographic salts and API keys. The authorization.xml file contains sensitive information that could be used to compromise the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-27161

GHSA-F63G-XH6J-Q56G

Affected Products

Apache

Getsimple Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27161.json · Exploit
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-f63g-xh6j-q56g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27161 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27161 · Vendor Advisory
• https://t.me/cveNotify/152684 · Telegram Post
• https://t.me/cveNotify/152996 · Telegram Post
• https://t.me/CVEtracker/45332 · Telegram Post
• https://twitter.com/CVEarity/status/2025181017360024029 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025055176441180585 · Twitter Post
• https://twitter.com/CVEnew/status/2025154207439863891 · Twitter Post
• https://t.me/poxek/5938 · Telegram Post