CVE-2026-27202: high-severity vulnerability in GetSimpleCMS-CE
GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.6%
GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. This issue has not been fixed at the time of publication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
GetSimpleCMS-CE · GetSimpleCMS-CERelated CVEs — GetSimpleCMS-CE
In the same product, most dangerous first.
CVE-2025-48492HIGHGetSimple CMS RCE in Edit componentEPSS 1.0%CVE-2026-53952CRITICALGetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic FlawEPSS 0.6%CVE-2026-56660CRITICALGetSimple CMS: CSRF, SSRF, and Unrestricted Zip ExtractionEPSS 0.5%CVE-2026-27161HIGHUnauthenticated Information Disclosure via .htaccess Reliance in Sensitive DirectoriesEPSS 0.5%CVE-2026-53953CRITICALGetSimple CMS: Predictable Password Reset Password Allows Administrator Account TakeoverEPSS 0.4%CVE-2026-71542HIGHGetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.phpEPSS 0.4%