# CVE-2026-63302: OpenSolution Quick.CMS Local File Inclusion in admin.php

Source: https://junglewise.ai/threats/cve-2026-63302-opensolution-quick-cms-local-file-inclusion-in-admin-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-63302 · Severity: info · CVSS 5.1 · Published 2026-07-28

Quick.CMS is a content management system used to build and manage websites. A security flaw in the administration panel allows an authorized administrator to view internal server directory structures and file paths that should normally be hidden. While this could help an attacker map out the server for further attacks, the vendor has stated they do not intend to release a fix as they consider the risk to be very low.

Technologies: [OpenSolution Quick.CMS](https://junglewise.ai/threats/technologies/quick-cms). Vendors: [OpenSolution](https://junglewise.ai/threats/vendors/opensolution).

## Quick answers

**Is CVE-2026-63302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63302 being exploited in the wild.

**How severe is CVE-2026-63302?** Informational severity, with a CVSS score of 5.1, published 28 July 2026.

**Which products and versions are affected?** OpenSolution Quick.CMS Through 6.8.0.

**Is there a fix for CVE-2026-63302?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63302 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63302?** Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Local File Inclusion (LFI) vulnerability exists in Quick.CMS through version 6.8.0 within the 'admin.php' endpoint. The application fails to properly sanitize the 'p' parameter, allowing an authenticated attacker with administrative privileges to include arbitrary files from the application's directory structure. Successful exploitation results in path disclosure, revealing the server's directory structure and absolute file paths. The vendor has acknowledged the report but determined that a fix is not necessary due to the requirement for administrative privileges.

## Affected products

- OpenSolution Quick.CMS Through 6.8.0

## Timeline

- 2026-07-28: disclosed: Disclosed by CERT Polska
- 2026-07-28: advisory

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-63301](https://cert.pl/en/posts/2026/07/CVE-2026-63301)
- [https://opensolution.org/](https://opensolution.org/)

## Related threats

- [OpenSolution Quick.CMS Blind SQL injection in administration panel](https://junglewise.ai/threats/cve-2026-33385-opensolution-quick-cms-blind-sql-injection-in-administration)
- [OpenSolution Quick.CMS path traversal in URI path](https://junglewise.ai/threats/cve-2026-63303-opensolution-quick-cms-path-traversal-in-uri-path)
- [OpenSolution Quick.CMS Denial of Service via primary language deletion](https://junglewise.ai/threats/cve-2026-63301-opensolution-quick-cms-denial-of-service-via-primary-language)
- [OpenSolution Quick.CMS insecure deserialization in admin panel](https://junglewise.ai/threats/cve-2026-11860-opensolution-quick-cms-insecure-deserialization-in-admin-panel)
- [OpenSolution QuickCMS Cross-Site Scripting via insecure plugin fetching](https://junglewise.ai/threats/cve-2026-33386-opensolution-quickcms-cross-site-scripting-via-insecure-plugin)