# CVE-2026-63301: OpenSolution Quick.CMS Denial of Service via primary language deletion

Source: https://junglewise.ai/threats/cve-2026-63301-opensolution-quick-cms-denial-of-service-via-primary-language  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-63301 · Severity: info · CVSS 7 · Published 2026-07-28

Quick.CMS is a content management system used to build and manage websites. A security flaw allows the deletion of the website's primary language, which causes the entire application to stop functioning (Denial of Service). While the administrative interface tries to hide this option, the underlying system does not actually block the request, meaning a malicious actor or a tricked administrator could crash the site.

Technologies: [OpenSolution Quick.CMS](https://junglewise.ai/threats/technologies/quick-cms). Vendors: [OpenSolution](https://junglewise.ai/threats/vendors/opensolution).

## Quick answers

**Is CVE-2026-63301 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63301 being exploited in the wild.

**How severe is CVE-2026-63301?** Informational severity, with a CVSS score of 7, published 28 July 2026.

**Which products and versions are affected?** OpenSolution Quick.CMS All through 6.8.0.

**Is there a fix for CVE-2026-63301?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63301 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63301?** Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Client-Side Enforcement of Server-Side Security (CWE-602) exists in Quick.CMS through version 6.8.0. While the administrative UI omits the option to delete the primary language, the backend API endpoint fails to perform a corresponding server-side check to prevent this action. An authenticated administrator can send a direct HTTP request to the language-deletion endpoint to remove the primary language, resulting in a persistent Denial of Service. Furthermore, this can be exploited by an unauthenticated attacker via Cross-Site Request Forgery (CSRF) if an authenticated admin visits a malicious link. The vendor has stated they do not intend to release a fix.

## Affected products

- OpenSolution Quick.CMS All through 6.8.0

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory: Advisory published by CERT.PL

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-63301](https://cert.pl/en/posts/2026/07/CVE-2026-63301)
- [https://opensolution.org/](https://opensolution.org/)

## Related threats

- [OpenSolution Quick.CMS Blind SQL injection in administration panel](https://junglewise.ai/threats/cve-2026-33385-opensolution-quick-cms-blind-sql-injection-in-administration)
- [OpenSolution Quick.CMS path traversal in URI path](https://junglewise.ai/threats/cve-2026-63303-opensolution-quick-cms-path-traversal-in-uri-path)
- [OpenSolution Quick.CMS Local File Inclusion in admin.php](https://junglewise.ai/threats/cve-2026-63302-opensolution-quick-cms-local-file-inclusion-in-admin-php)
- [OpenSolution Quick.CMS insecure deserialization in admin panel](https://junglewise.ai/threats/cve-2026-11860-opensolution-quick-cms-insecure-deserialization-in-admin-panel)
- [OpenSolution QuickCMS Cross-Site Scripting via insecure plugin fetching](https://junglewise.ai/threats/cve-2026-33386-opensolution-quickcms-cross-site-scripting-via-insecure-plugin)