CVE-2026-71426
Deferred Deferred - Pending Action

Authenticated Directory Traversal in GetSimple CMS

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: GitHub, Inc.

Description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is passed unsanitized to a PHP include() when the page is rendered. Because the include path is never confined, this allows directory-traversal Local File Inclusion: arbitrary local files are included (and, if they contain PHP, executed) when any visitor requests the page. At time of publication, there are no publicly available patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-02
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-71426
EUVD
EUVD-2026-91020

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
getsimple cms to 3.3.22 (exc)
getsimple cms From 3.3.22 (inc)
getsimplecms getsimple_cms to 3.3.22 (inc)
getsimplecms getsimple_cms_ce to 3.3.22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Local File Inclusion (LFI) vulnerability in GetSimple CMS versions 3.3.22 and prior. An authenticated user with page-editing rights can store a malicious filesystem path in a page's template attribute. When the page is rendered, this unsanitized path is passed to a PHP include() function, allowing directory traversal and arbitrary file inclusion. Attackers can access and execute any server-readable file, including sensitive files like configuration files.

Detection Guidance

Check GetSimple CMS versions 3.3.22 or earlier for pages with modified template fields containing suspicious filesystem paths. Inspect server logs for requests accessing files outside the web root or including sensitive files like /etc/passwd or gsconfig.php.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the server, such as configuration files containing secrets like passwords or encryption keys. It can also lead to code execution if the included files contain PHP code. The impact includes unauthorized data disclosure, potential system compromise, and further attacks leveraging exposed credentials.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (protected health information). It may result in data breaches, unauthorized disclosures, and failure to maintain confidentiality and integrity of personal or health data.

Mitigation Strategies

Restrict page-editing rights to trusted users only. Monitor and audit template field modifications. Consider disabling the template feature temporarily until a patch is available. Review server access logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart