XSS in Getsimple-Ce Getsimple Cms
CVE-2026-27147
GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG files via the administrative upload functionality, but they are not properly sanitized or restricted, allowing an attacker to embed malicious JavaScript. When the uploaded SVG file is accessed, the script executes in the browser. This issue does not have a fix at the time of publication.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (14.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 14.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.001
Affected products
- Getsimple-Ce Getsimple Cms
- Getsimplecms-Ce — versions <= 3.3.22
Weakness classification (CWE)
References
- github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-5gmq-hrcx-6… (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-27147?
- CVE-2026-27147 is a medium-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-02-21.
- How severe is CVE-2026-27147?
- Medium severity. CVSS v3 base score is 5.4 out of 10.