CVE-2026-27146

GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a result, an attacker can craft a malicious web page that silently triggers a file upload request from an authenticated victim’s browser. The request is accepted without requiring a CSRF token or origin validation. This allows an attacker to upload arbitrary files to the application without the victim’s knowledge or consent. In order to exploit this vulnerability, the victim must be authenticated to GetSimple CMS (e.g., admin user), and visit an attacker-controlled webpage. This issue does not have a fix at the time of publication.

• CWE-352
• CWE-434
• CWE-352

• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-26rv-8wpp-q84rExploit, Mitigation, Vendor Advisory

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27140SWIG file names containing 'cgo' and well-crafted payloads c…8.8
• CVE-2026-27141Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames wi…7.5
• CVE-2026-27142Actions which insert URLs into the content attribute of HTML…6.1
• CVE-2026-27143Arithmetic over induction variables in loops were not correc…9.8
• CVE-2026-27144The compiler is meant to unwrap pointers which are the opera…7.1
• CVE-2026-27145(*x509.Certificate).VerifyHostname previously called matchHo…6.5
• CVE-2026-27147GetSimple CMS is a content management system. All versions o…5.4
• CVE-2026-27148Storybook is a frontend workshop for building user interface…9.6
• CVE-2026-27149Discourse is an open source discussion platform. Prior to ve…6.5
• CVE-2026-27150Discourse is an open source discussion platform. Prior to ve…3.8
• CVE-2026-27151Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-27152Discourse is an open source discussion platform. Prior to ve…3.8