What is CVE-2026-27147?

CVE-2026-27147 is a medium-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-02-21.

How severe is CVE-2026-27147?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Getsimple-Ce Getsimple Cms

CVE-2026-27147

GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG files via the administrative upload functionality, but they are not properly sanitized or restricted, allowing an attacker to embed malicious JavaScript. When the uploaded SVG file is accessed, the script executes in the browser. This issue does not have a fix at the time of publication.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (9.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Getsimple-ce Getsimple_cms
Getsimplecms-ce — versions <= 3.3.22

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-27147?: CVE-2026-27147 is a medium-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-02-21.
How severe is CVE-2026-27147?: Medium severity. CVSS v3 base score is 5.4 out of 10.