GetSimple CMS CE: Unrestricted ZIP extraction in update handler leads to RCE
Summary
The update handler (UpdateCE plugin) of GetSimple CMS CE extracts ZIP archives into the web root without checking file types or entry paths. An attacker who can get a malicious archive processed can write PHP files into a web-accessible directory and run commands as the web server user. Directory traversal entries (../) can also write files outside the extraction directory. The CVSS vector assumes high privileges are required, and the advisory notes the flaw can also be reached through separately tracked CSRF and SSRF issues.
Affected
- GetSimpleCMS-CE GetSimple CMS CE versions below 1.5 (the GitHub advisory lists <= 1.4)
Fixed in
- Upgrade to version 1.5 or later
Workaround
- No vendor workaround published.
- Interim measures from third-party guidance, not validated by the vendor: disable or restrict the update function, limit access to the admin area to trusted administrators, restrict outbound connections from the web server, and block execution of UpdateCE.php or move it out of the web root. These may break the update function.
Exploitation
- CISA SSVC lists exploitation as 'poc' (proof of concept available) and automatable as 'no'.
- Not listed in CISA KEV.
- Sources disagree on whether a public exploit exists; the advisory includes a PoC.
- EPSS is about 0.5%.
Our recommendation
- Inventory all GetSimple CMS CE installations and confirm their versions.
- Upgrade installations below 1.5 after testing on a copy, and verify the 1.5 release source before installing.
- Until then, restrict or disable the update function and limit admin access to trusted networks and accounts.
- Review web server logs for unexpected update requests, new PHP files in the web root, and unusual outbound requests from the server.
- Check related CVE-2026-56661 (SSRF) and CVE-2026-56662 (CSRF) together with this one.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-q5rx-gppg-768r github.com
- OpenCVE: CVE-2026-56660 app.opencve.io
- VulDB: CVE-2026-56660 vuldb.com
- Vulners VulnRichment: CVE-2026-56660 vulners.com
- TheHackerWire: CVE-2026-56660 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:43.
Original description (NVD)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.