CVE-2026-56661

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.

• CWE-918

• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-r7v8-mx29-5q8h
• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-r7v8-mx29-5q8h

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56651Dool in versions up to 1.3.8 is vulnerable to symlink follow…2
• CVE-2026-56652Dool in versions up to 1.3.8 is vulnerable to a CSV injectio…4.6
• CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in AP…9.8
• CVE-2026-56657Gitea SSH Key Parser Denial of Service6.2
• CVE-2026-5666A vulnerability was detected in code-projects Online FIR Sys…5.3
• CVE-2026-56660GetSimple CMS is a content management system (CMS), and GetS…9.1
• CVE-2026-56662GetSimple CMS is a content management system (CMS), and GetS…9.6
• CVE-2026-56663AutoGPT is a workflow automation platform for creating, depl…8.5
• CVE-2026-56664ZITADEL is an open source identity management platform. Prio…4.2
• CVE-2026-56665ZITADEL is an open source identity management platform. Prio…4.2
• CVE-2026-56666ZITADEL is an open source identity management platform. Prio…4.8
• CVE-2026-56667ZITADEL is an open source identity management platform. Prio…7.3