CVE-2026-5203 Details
Description
A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This issue has been reported early to the project. They confirmed, that "this has already been discovered and fixed for the next release."
A path traversal vulnerability has been identified in CMS Made Simple (CMSMS) versions through 2.2.22. The issue resides in the UserGuide module's XML import functionality, specifically within the '_copyFilesToFolder' function of 'modules/UserGuide/lib/class.UserGuideImporterExporter.php'. This vulnerability allows authenticated administrators to upload arbitrary files to any location on the server filesystem, potentially leading to remote code execution. The vulnerability arises because the function fails to properly sanitize user-supplied filenames and directory paths from imported XML files, allowing for the injection of path traversal sequences.
It is recommended to implement strict validation on the 'filename' to reject path traversal sequences, use basename() to extract only the filename, whitelist allowed file extensions and characters, and ensure files can only be written to designated upload directories.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 31, 2026CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.proton.me/urls/Q0JHZ339BW#X9P2G3Guwvwa | [email protected] | ExploitRemedy |
| https://vuldb.com/submit/772855 | [email protected] | Technical Description |
| https://vuldb.com/vuln/354331 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/354331/cti | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CMS Made Simple | <= 2.2.22 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |