CVE-2026-27161 Details
Description
GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.
A vulnerability exists in GetSimple CMS versions through 3.3.22, allowing unauthenticated attackers to access sensitive files. The issue arises because the CMS relies on .htaccess files to protect directories such as /data/ and /backups/. In environments where Apache AllowOverride is disabled, these protections are ignored. Attackers can exploit this to list and download files, including authorization.xml, which contains cryptographic salts and API keys. This vulnerability is critical and has no available fix.
It is recommended to move sensitive directories outside the web root, enforce application-level access controls instead of relying on .htaccess, validate Apache configurations during installation, and add runtime checks to prevent serving sensitive files regardless of server settings.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-f63g-xh6j-q56g | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getsimple-ce getsimple cms | <= 3.3.22 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 24, 2026 | Initial Analysis | [email protected] |
| Feb 21, 2026 | New CVE Received | [email protected] |