CVE-2026-63302
Received Received - Intake

Local File Inclusion in Quick.CMS via admin.php p parameter

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: CERT.PL

Description
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure). The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-63302
EUVD
EUVD-2026-49755

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opensolution quick_cms to 6.8.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Quick.CMS has a Local File Inclusion (LFI) vulnerability in the admin.php endpoint via the p parameter. An authenticated admin can include arbitrary files within the application's directory by sending a crafted HTTP request. This may expose the server's directory structure and absolute file paths.

Detection Guidance

Check for suspicious requests to admin.php with the p parameter in web server logs. Look for patterns like 'p=../../../../etc/passwd' or similar attempts to traverse directories. Use tools like curl to test if the endpoint is vulnerable by sending crafted requests.

Impact Analysis

An attacker with admin access could exploit this to read sensitive files on the server, potentially exposing configuration files, credentials, or other confidential data. However, exploitation requires admin privileges and the vendor considers the risk very low.

Compliance Impact

This LFI vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR or HIPAA if personal or health information is exposed. However, the vendor assessed exploitation likelihood as very low and no fix is planned.

Mitigation Strategies

Restrict access to the admin.php endpoint to trusted IPs only. Ensure strong authentication for admin accounts. Monitor logs for unauthorized access attempts. Consider upgrading to a patched version if available, though the vendor has not provided one.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart