CVE-2026-27146 is a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions of GetSimple CMS, specifically impacting the administrative file upload endpoint. An authenticated user visiting a malicious webpage can unknowingly trigger the upload of arbitrary files to the CMS due to the lack of CSRF protection. This medium-severity vulnerability (CVSS 4.5) requires high privileges and user interaction, but has a high impact on integrity. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability, and no fix is available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.3.22CPE matchmatch criteria | cpe:2.3:a:getsimple-ce:getsimple_cms:*:*:*:*:community:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.