CVE-2026-63303: medium-severity vulnerability in OpenSolution Quick.CMS
Path Traversal in Quick.CMS
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.6%
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
OpenSolution · Quick.CMSRelated CVEs — OpenSolution Quick.CMS
In the same product, most dangerous first.
CVE-2026-63301HIGHDenial of Service in Quick.CMSEPSS 0.6%CVE-2026-63302MEDIUMLocal File Inclusion in Quick.CMSEPSS 0.5%CVE-2026-33385MEDIUMBlind SQL Injection in Quick.CMSEPSS 0.4%CVE-2026-11860HIGHInsecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMSEPSS 0.2%CVE-2025-54172MEDIUMStored Cross-Site Scripting in QuickCMSEPSS 0.2%CVE-2025-54174MEDIUMCross-Site Request Forgery in QuickCMSEPSS 0.2%