# CVE-2026-56660: GetSimple CMS unrestricted ZIP extraction in UpdateCE plugin

Source: https://junglewise.ai/threats/cve-2026-56660-getsimple-cms-is-a-content-management-system-cms-and-getsimple  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-56660 · Severity: critical · CVSS 9.1 · Published 2026-10-01

GetSimple CMS Community Edition is a content management system. The update handler in versions prior to 1.5 downloads and extracts ZIP archives into the web-accessible directory without validating file types or paths. An attacker who can supply a malicious archive achieves remote code execution by writing PHP files directly into the web root, with potential to write files anywhere on the system via directory traversal.

Technologies: [GetSimple CMS CE](https://junglewise.ai/threats/technologies/getsimple-cms-ce). Vendors: [GetSimple](https://junglewise.ai/threats/vendors/getsimple).

## Quick answers

**Is CVE-2026-56660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56660 being exploited in the wild.

**How severe is CVE-2026-56660?** Critical severity, with a CVSS score of 9.1, published 1 October 2026.

**Which products and versions are affected?** GetSimple CMS CE prior to 1.5.

**Is there a fix for CVE-2026-56660?** Yes: fixed in 1.5. Until then: Restrict access to the update handler to trusted administrators only. Disable or remove the UpdateCE plugin if updates are not required. Implement strict file-upload and content-type validation at the web-server level. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56660 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-56660?** Check whether you run GetSimple CMS CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.5

Restrict access to the update handler to trusted administrators only. Disable or remove the UpdateCE plugin if updates are not required. Implement strict file-upload and content-type validation at the web-server level.

## Technical details

The UpdateCE.php plugin extracts ZIP archives to the web root without magic-byte validation, file-type restrictions, or path-traversal protection. An authenticated administrator (or an attacker exploiting separate CSRF/SSRF issues to bypass authentication) can trigger the extraction of a crafted archive containing PHP files or directory-traversal entries. The extracted PHP files land in the web-accessible directory and execute as the web-server user, achieving full remote code execution.

## Affected products

- GetSimple GetSimple CMS CE prior to 1.5

## Timeline

- 2026-07-06: advisory
- 2026-10-01: disclosed

## References

- [https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-q5rx-gppg-768r](https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-q5rx-gppg-768r)

## Related threats

- [GetSimple CMS stored XSS in backup viewer](https://junglewise.ai/threats/cve-2026-70650-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS CE cross-site request forgery in UpdateCE](https://junglewise.ai/threats/cve-2026-56662-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS server-side request forgery in update handler](https://junglewise.ai/threats/cve-2026-56661-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS password reset authentication bypass](https://junglewise.ai/threats/cve-2026-53953-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS unauthenticated admin account creation via setup script](https://junglewise.ai/threats/cve-2026-53952-getsimple-cms-unauthenticated-admin-account-creation-via-setup)