CVE-2026-27146
CSRF Vulnerability in GetSimple CMS Allows Arbitrary File Upload
Publication date: 2026-02-21
Last updated on: 2026-02-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| getsimple-ce | getsimple_cms | to 3.3.22 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-27146 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in GetSimple CMS versions up to and including 3.3.22, specifically affecting the administrative file upload endpoint at /admin/upload.php.'}, {'type': 'paragraph', 'content': 'The vulnerability exists because the application does not implement CSRF protection mechanisms such as CSRF tokens or origin validation on this endpoint.'}, {'type': 'paragraph', 'content': "As a result, an attacker can create a malicious webpage that, when visited by an authenticated GetSimple CMS user (such as an admin), silently triggers a file upload request without the user's knowledge or consent."}, {'type': 'paragraph', 'content': 'This request is accepted by the server without requiring any CSRF token or origin check, allowing the attacker to upload arbitrary files to the server.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have several serious impacts:'}, {'type': 'list_item', 'content': "Unauthorized file uploads to the server without the victim's knowledge."}, {'type': 'list_item', 'content': 'Hosting of persistent malicious content on the website.'}, {'type': 'list_item', 'content': 'Abuse of server storage resources.'}, {'type': 'list_item', 'content': 'Potential website defacement.'}, {'type': 'list_item', 'content': 'If combined with insufficient file validation (e.g., allowing SVG files), it can lead to stored Cross-Site Scripting (XSS) attacks without requiring direct user interaction.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unauthorized or unexpected POST requests to the administrative file upload endpoint /admin/upload.php on GetSimple CMS servers.'}, {'type': 'paragraph', 'content': 'You can look for suspicious file uploads in the /data/uploads/ directory, especially those triggered without explicit user interaction.'}, {'type': 'paragraph', 'content': 'Network detection can involve capturing HTTP traffic and filtering for POST requests to /admin/upload.php that originate from authenticated sessions but are triggered from external or suspicious sources.'}, {'type': 'list_item', 'content': 'Use tools like tcpdump or Wireshark to capture HTTP traffic and filter for POST requests to /admin/upload.php.'}, {'type': 'list_item', 'content': "Example tcpdump command: tcpdump -i eth0 -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'POST /admin/upload.php'"}, {'type': 'list_item', 'content': 'Check web server logs (e.g., access.log) for POST requests to /admin/upload.php that do not include valid CSRF tokens or have suspicious Referer headers.'}, {'type': 'list_item', 'content': "Example grep command: grep 'POST /admin/upload.php' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': 'Inspect the /data/uploads/ directory for recently uploaded files that may be suspicious or unexpected.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Since no patched versions are available at the time of publication, immediate mitigation steps focus on reducing the risk of exploitation.
- Restrict access to the administrative interface to trusted IP addresses or VPNs to limit exposure.
- Implement web application firewall (WAF) rules to block or alert on suspicious POST requests to /admin/upload.php.
- Educate authenticated users, especially administrators, to avoid visiting untrusted or suspicious websites while logged into the CMS.
- Manually monitor and review uploaded files in the /data/uploads/ directory for unauthorized content.
- If possible, implement custom CSRF protections such as validating Origin or Referer headers on the server side as a temporary workaround.