What is CVE-2026-27161?

CVE-2026-27161 is a high-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-02-21.

How severe is CVE-2026-27161?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Getsimple-Ce Getsimple Cms

CVE-2026-27161

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.

Vulnerability class: Information Disclosure

EPSS: 0.004 (33.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Getsimple-ce Getsimple_cms
Getsimplecms-ce — versions <= 3.3.22

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-27161?: CVE-2026-27161 is a high-severity vulnerability in Getsimple-Ce Getsimple Cms, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-02-21.
How severe is CVE-2026-27161?: High severity. CVSS v3 base score is 7.5 out of 10.