CVE-2026-56661
Deferred Deferred - Pending Action

Server-Side Request Forgery in GetSimple CMS CE

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: GitHub, Inc.

Description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-02
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-56661
EUVD
EUVD-2026-91017

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
getsimple cms 1.5
getsimple cms_ce *
getsimple cms to 1.5 (exc)
getsimple cms_ce to 1.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56661 is a Server-Side Request Forgery (SSRF) vulnerability in GetSimple CMS CE versions 1.4 and below. The issue occurs in the update endpoint where the application fetches a user-supplied URL using file_get_contents() after only validating the URL format. Attackers can make the server request arbitrary internal or external endpoints, including cloud metadata services. The fetched response is saved to a web-accessible file and not deleted if invalid, enabling full-read SSRF where attackers can retrieve internal responses directly.

Detection Guidance

Check for unauthorized requests to internal services or cloud metadata endpoints (169.254.169.254) in server logs. Look for suspicious file creation in web-accessible directories like /Tmpfile.zip. Monitor network traffic for outbound connections to unexpected destinations.

Impact Analysis

An attacker with administrator access could exploit this to exfiltrate sensitive data like database passwords by targeting internal services (e.g., 127.0.0.1:8080). The attacker could also access cloud metadata endpoints, enumerate internal services, or cause resource consumption due to lack of request timeout and unbounded fetch size.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exfiltration of internal data may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade GetSimple CMS CE to version 1.5 or later immediately. If upgrading is not possible, restrict access to the update endpoint and block outbound requests to internal IP ranges and cloud metadata endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart