CVE-2026-5203
Path Traversal in CMS Made Simple UserGuide Module Allows Remote Exploit
Publication date: 2026-03-31
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cms_made_simple | cms_made_simple | to 2.2.22 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in CMS Made Simple up to version 2.2.22, specifically in the function _copyFilesToFolder within the UserGuide Module XML Import component. It allows an attacker to perform a path traversal attack by manipulating the function, which can be exploited remotely.
The issue was reported early and has been confirmed as fixed in the next release of the software.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to manipulate file paths, potentially accessing or overwriting files outside the intended directory. This can lead to unauthorized access to sensitive files, data leakage, or modification of critical files within the system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been confirmed and fixed in the next release of CMS Made Simple. Immediate mitigation steps include updating the CMS Made Simple installation to the latest version once it is available.
Since the vulnerability allows remote path traversal via the UserGuide Module XML Import component, restricting access to this module or disabling it temporarily could reduce risk until the patch is applied.