IT SBIT Services
Schneeberger
DEEN
CVE tracker

GetSimpleCMS-CE: Cross-site request forgery in UpdateCE enables remote code execution

CVE-2026-56662Critical 9.6

← All vulnerabilities

Summary

GetSimpleCMS-CE, a flat-file content management system, has a UpdateCE update form that lacks anti-CSRF protection and does not verify the request origin. An attacker can host a page that automatically submits a forged request to the update endpoint, causing the server to download and deploy attacker-chosen content. Exploitation requires that a logged-in administrator visits the attacker's page; the deployed content is executed, which leads to remote code execution. A secondary HTML injection exists because the url field is written unescaped into the form.

Affected

  • GetSimpleCMS-CE versions below 1.5 (the advisory lists <= 1.4)
  • Version mapping between the CVE's 1.5 and the CE release numbering (3.3.x) is not fully confirmed; check the GHSA advisory

Fixed in

  • Upgrade to GetSimpleCMS-CE 1.5 or later (per the CVE and advisory text)

Workaround

  • No vendor-documented workaround known.
  • Restrict access to the admin interface to trusted networks or VPN.
  • Limit outbound connections from the server to trusted update sources.
  • Ask administrators not to browse other websites while logged into the admin panel until the upgrade is complete.

Exploitation

  • CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
  • Not listed in the CISA KEV catalog; no known active exploitation.
  • Public proof of concept: conflicting information; treat as unknown and recheck.
  • EPSS score reported at 0.00216 (low).

Our recommendation

  • Inventory all GetSimple CE installations and confirm their versions.
  • Upgrade to version 1.5 or later after confirming the version mapping in the GHSA advisory.
  • Restrict admin panel access to trusted networks or VPN.
  • Monitor the web server for unexpected file changes and outbound downloads.
  • Treat this as high priority, especially where the admin panel is internet-reachable.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:27.

Original description (NVD)

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the server performs an attacker-directed download-and-deploy operation in the administrator's session — with no further interaction. Because the deployed content is executed (see the related ZIP-extraction advisory), this yields remote code execution. The url field is additionally written into the form unescaped, providing a secondary HTML-injection sink via a malicious upgrade.json. This issue has been patched in version 1.5.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed