CVE-2026-53952 Details
Description
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.
A critical logic flaw has been identified in GetSimple CMS versions through 3.4.0a and in GetSimple CMS CE versions through 3.3.22. This vulnerability allows unauthenticated attackers to create new administrator accounts. The issue arises because the application fails to properly delete the 'admin/setup.php' file after installation, due to a self-exclusion bug in the deletion logic. As a result, the setup script remains accessible for unauthorized account creation, even after a legitimate installation.
The deletion logic should be adjusted to run after the 'setup.php' file has been executed, or the 'setup.php' file should check for an existing site configuration before allowing account creation. A suggested patch is to include a check for the 'gsconfig.php' file and verify that the site has not already been set up.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-rw2c-w4mg-46g4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-489 | Active Debug Code | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GetSimple CMS | <= 3.4.0a |
CPE
Remediation
| |
| GetSimple CMS CE | <= 3.3.22 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |