# CVE-2026-63303: OpenSolution Quick.CMS path traversal in URI path

Source: https://junglewise.ai/threats/cve-2026-63303-opensolution-quick-cms-path-traversal-in-uri-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-63303 · Severity: info · CVSS 5.1 · Published 2026-07-28

Quick.CMS, a content management system used for building websites, contains a security flaw that could allow an administrator to access files they should not be able to see. By manipulating web addresses, a user with administrative privileges can bypass security boundaries to read files located outside of the standard web folder. The software vendor has stated they do not intend to release a fix, as they consider the risk of exploitation to be very low.

Technologies: [OpenSolution Quick.CMS](https://junglewise.ai/threats/technologies/quick-cms). Vendors: [OpenSolution](https://junglewise.ai/threats/vendors/opensolution).

## Quick answers

**Is CVE-2026-63303 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63303 being exploited in the wild.

**How severe is CVE-2026-63303?** Informational severity, with a CVSS score of 5.1, published 28 July 2026.

**Which products and versions are affected?** OpenSolution Quick.CMS Through 6.8.0.

**Is there a fix for CVE-2026-63303?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63303 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-63303?** Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A relative path traversal vulnerability (CWE-23) exists in Quick.CMS through version 6.8.0. The application fails to properly normalize dot-dot-slash (../) sequences within the URI path component of HTTP requests before resolving the file path. An authenticated attacker with administrative privileges can exploit this to read sensitive files located in directories adjacent to the webroot. The vendor has acknowledged the report but determined that no patch is necessary, citing a low likelihood of exploitation.

## Affected products

- OpenSolution Quick.CMS Through 6.8.0

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-63301](https://cert.pl/en/posts/2026/07/CVE-2026-63301)
- [https://opensolution.org/](https://opensolution.org/)

## Related threats

- [OpenSolution Quick.CMS Blind SQL injection in administration panel](https://junglewise.ai/threats/cve-2026-33385-opensolution-quick-cms-blind-sql-injection-in-administration)
- [OpenSolution Quick.CMS Local File Inclusion in admin.php](https://junglewise.ai/threats/cve-2026-63302-opensolution-quick-cms-local-file-inclusion-in-admin-php)
- [OpenSolution Quick.CMS Denial of Service via primary language deletion](https://junglewise.ai/threats/cve-2026-63301-opensolution-quick-cms-denial-of-service-via-primary-language)
- [OpenSolution Quick.CMS insecure deserialization in admin panel](https://junglewise.ai/threats/cve-2026-11860-opensolution-quick-cms-insecure-deserialization-in-admin-panel)
- [OpenSolution QuickCMS Cross-Site Scripting via insecure plugin fetching](https://junglewise.ai/threats/cve-2026-33386-opensolution-quickcms-cross-site-scripting-via-insecure-plugin)