CVE-2026-27202
Published: 21 February 2026
Summary
CVE-2026-27202 is a high-severity Path Traversal (CWE-22) vulnerability in Getsimple-Ce Getsimple Cms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-27202 affects all versions of GetSimple CMS, a content management system. The vulnerability is a flaw in the Uploaded Files feature that enables arbitrary file reads, mapped to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-23 (Relative Path Traversal). Published on 2026-02-21, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation grants access to read arbitrary files on the affected server, potentially exposing sensitive data such as configuration files, user credentials, or other server contents.
The GitHub security advisory (GHSA-xhwv-g6q4-h886) notes that no fix is available as of publication. Security practitioners should monitor for updates from the GetSimpleCMS-CE repository and consider restricting access to upload functionalities or implementing web application firewalls to detect path traversal attempts in the interim.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7749
Vulnerability details
GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. This issue has not been fixed at the time of publication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing GetSimple CMS directly enables remote exploitation of the web application (T1190) and arbitrary local file reads for data collection (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly mitigates path traversal in the Uploaded Files feature by validating file path inputs to prevent traversal sequences like '../'.
AC-6 limits damage from arbitrary file reads by enforcing least privilege on the CMS process, restricting access to sensitive files outside the web directory.
SC-7 provides boundary protection via web application firewalls to inspect and block HTTP requests containing path traversal payloads targeting the Uploaded Files feature.