Executive brief
GetSimple CMS is a popular open-source content management system. A logic flaw in the setup script deletion logic leaves the installation script accessible even after the site is configured, allowing attackers without any authentication to create new administrator accounts and gain full control of the CMS. This can lead to complete website compromise, data theft, and malware installation.
Technical details
The vulnerability is an improper authorization and missing authentication issue in admin/setup.php. The root cause is a self-exclusion logic flaw in admin/inc/common.php (around line 285) where the file deletion logic skips cleanup whenever setup.php itself is being executed. Specifically, the condition `get_filename_id() != 'setup'` evaluates to false when setup.php is accessed, preventing the file from being deleted. Since setup.php lacks authentication checks and does not verify the existence of gsconfig.php before processing POST requests, any unauthenticated attacker can directly POST account creation data to /admin/setup.php and create a new XML-based administrator account. The attack requires only network access, no authentication, and no user interaction. Exploitation results in full administrative takeover and can be chained with theme editing features for remote code execution. No patched versions are currently available as of publication.
Affected products
- GetSimple GetSimple CMS 3.4.0a and below
- GetSimple GetSimple CMS CE 3.3.22 and below
Timeline
- 2026-09-11: disclosed: CVE published on NVD
- 2026-06-03: advisory: GitHub Security Advisory GHSA-rw2c-w4mg-46g4 published