# CVE-2026-56661: GetSimple CMS server-side request forgery in update handler

Source: https://junglewise.ai/threats/cve-2026-56661-getsimple-cms-is-a-content-management-system-cms-and-getsimple  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-56661 · Severity: high · CVSS 7.5 · Published 2026-10-01

GetSimple CMS is a web-based content management system used to build and maintain websites. The update handler in versions before 1.5 allows an authenticated administrator to trigger requests to arbitrary internal services and cloud metadata endpoints. Because the fetched response is written to a publicly accessible file and not deleted if invalid, an attacker can read sensitive internal data, enumerate internal services, or exfiltrate cloud credentials.

Technologies: [GetSimple CMS CE](https://junglewise.ai/threats/technologies/getsimple-cms-ce). Vendors: [GetSimple](https://junglewise.ai/threats/vendors/getsimple).

## Quick answers

**Is CVE-2026-56661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56661 being exploited in the wild.

**How severe is CVE-2026-56661?** High severity, with a CVSS score of 7.5, published 1 October 2026.

**Which products and versions are affected?** GetSimple CMS CE before 1.5.

**Is there a fix for CVE-2026-56661?** Yes: fixed in 1.5. Until then: Restrict access to the UpdateCE plugin's update endpoint to trusted administrators only, or disable the update feature if automatic updates are not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56661 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-56661?** Check whether you run GetSimple CMS CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.5

Restrict access to the UpdateCE plugin's update endpoint to trusted administrators only, or disable the update feature if automatic updates are not required.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in the UpdateCE plugin's update endpoint. The vulnerable code fetches a user-supplied URL using file_get_contents() after only syntax validation (FILTER_VALIDATE_URL), with no allowlist of permitted destinations. The response body is written to /Tmpfile.zip in the web root; it is deleted only if the content is a valid ZIP archive. An attacker with authenticated admin access can supply URLs pointing to internal services, cloud metadata endpoints (169.254.169.254), or localhost services; non-ZIP responses remain readable at the web-accessible path, turning a blind SSRF into a full-read vulnerability.

## Affected products

- GetSimple CMS CE before 1.5

## Timeline

- 2026-07-06: disclosed
- 2026-07-06: patched: version 1.5 released

## References

- [https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-r7v8-mx29-5q8h](https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-r7v8-mx29-5q8h)

## Related threats

- [GetSimple CMS stored XSS in backup viewer](https://junglewise.ai/threats/cve-2026-70650-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS CE cross-site request forgery in UpdateCE](https://junglewise.ai/threats/cve-2026-56662-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS unrestricted ZIP extraction in UpdateCE plugin](https://junglewise.ai/threats/cve-2026-56660-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS password reset authentication bypass](https://junglewise.ai/threats/cve-2026-53953-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS unauthenticated admin account creation via setup script](https://junglewise.ai/threats/cve-2026-53952-getsimple-cms-unauthenticated-admin-account-creation-via-setup)