GetSimple CMS CE: Stored XSS in page backup viewer
Summary
GetSimple CMS CE up to and including 3.3.22 contains an authenticated stored Cross-Site Scripting vulnerability in the page backup viewer (admin/backup-edit.php). The viewer decodes page Keywords, Description, Menu text and Content before printing them without re-escaping. A user with page editing rights can store JavaScript that runs in the browser of an administrator who opens the backup of that page, within the admin control panel.
Affected
- GetSimple CMS CE versions up to and including 3.3.22
- Component: admin/backup-edit.php (page backup viewer)
Fixed in
Unknown. No patched version was published at the time of publication. 3.3.22 is itself affected.
Workaround
- Limit page editing rights to a small set of trusted accounts and remove accounts that no longer need them.
- Have administrators review page Keywords, Description, Menu text and Content for unexpected script or markup, especially on pages edited by others.
- Restrict admin area access by IP or VPN and enforce strong, unique passwords with MFA where supported.
- No vendor-published workaround found.
Exploitation
- Not listed in CISA KEV; no known active exploitation.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found.
- EPSS score: unknown.
Our recommendation
- Inventory all GetSimple CE installations and their exact versions.
- Reduce the number of editor accounts and review who can edit pages.
- Review page content for unexpected script or markup, especially after edits by other users.
- Check the GitHub advisory and the GetSimple CE release page regularly for a fixed version and upgrade when available.
- Upgrade any installation older than 3.3.22 to 3.3.22 first, to address the more serious CVE-2025-48492 remote code execution issue.
- Note: the CVSS 4.0 vector (PR:N/UI:N) does not match the stated preconditions; the practical risk is likely lower than the score of 8.8 suggests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p6vf-2xr7-mcf4 github.com
- OSV: CVE-2026-70650 osv.dev
- OpenCVE: CVE-2026-70650 app.opencve.io
- GetSimple CE releases github.com
- SOCRadar: GetSimple CE vendor page cve.socradar.io
- GHSA-5gmq-hrcx-6w45 (related SVG upload XSS) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:54.
Original description (NVD)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.php). Page fields are correctly HTML-encoded when a page is saved, but the backup viewer decodes them again (htmldecode() / strip_decode()) and prints the result without re-escaping. A user who can edit a page can store JavaScript in a page's Keywords, Description, Menu text or Content; it executes in the browser of any administrator who later views that page's backup, in the context of the admin control panel. At time of publication, there are no publicly available patches.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.