CSRF in Getsimple-Ce Getsimple Cms
CVE-2026-27146
GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a result, an attacker can craft a malicious web page that silently triggers a file upload request from an authenticated victim’s browser. The request is accepted without requiring a CSRF token or origin validation. This allows an attacker to upload arbitrary files to the application without the victim’s knowledge or consent. In order to exploit this vulnerability, the victim must be authenticated to GetSimple CMS (e.g., admin user), and visit an attacker-controlled webpage. This issue does not have a fix at the time of publication.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.002 (6.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: -0.000
Affected products
- Getsimple-Ce Getsimple Cms
- Getsimplecms-Ce — versions <= 3.3.22
Weakness classification (CWE)
References
- github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-26rv-8wpp-q… (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-27146?
- CVE-2026-27146 is a medium-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.5/10. Published 2026-02-21.
- How severe is CVE-2026-27146?
- Medium severity. CVSS v3 base score is 4.5 out of 10.