CVE-2026-56660

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.

• CWE-352
• CWE-434
• CWE-918

• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-q5rx-gppg-768r
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-q5rx-gppg-768r

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56650Heap-based buffer overflow in Windows Network File System al…7.8
• CVE-2026-56651Dool in versions up to 1.3.8 is vulnerable to symlink follow…2
• CVE-2026-56652Dool in versions up to 1.3.8 is vulnerable to a CSV injectio…4.6
• CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in AP…9.8
• CVE-2026-56657Gitea SSH Key Parser Denial of Service6.2
• CVE-2026-5666A vulnerability was detected in code-projects Online FIR Sys…5.3
• CVE-2026-56661GetSimple CMS is a content management system (CMS), and GetS…7.5
• CVE-2026-56662GetSimple CMS is a content management system (CMS), and GetS…9.6
• CVE-2026-56663AutoGPT is a workflow automation platform for creating, depl…8.5
• CVE-2026-56664ZITADEL is an open source identity management platform. Prio…4.2
• CVE-2026-56665ZITADEL is an open source identity management platform. Prio…4.2
• CVE-2026-56666ZITADEL is an open source identity management platform. Prio…4.8