What is CVE-2026-27161?

CVE-2026-27161 is a high-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-02-21.

How severe is CVE-2026-27161?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Getsimple-Ce Getsimple Cms

CVE-2026-27161

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.

Vulnerability class: Information Disclosure

Published 2026-02-21 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (37.8th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001

Affected products

Getsimple-Ce Getsimple Cms
Getsimplecms-Ce — versions <= 3.3.22

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-f63g-xh6j-q… (Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-27161?: CVE-2026-27161 is a high-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-02-21.
How severe is CVE-2026-27161?: High severity. CVSS v3 base score is 7.5 out of 10.