Executive brief
CMSimple is a lightweight, database-free PHP content management system used to build and maintain websites. The CoAuthors plugin contains a critical vulnerability in its content import feature that allows authenticated users with page editing permissions to execute arbitrary code on the web server by uploading specially crafted content files. Successful exploitation leads to complete server compromise and potential theft of sensitive data.
Technical details
The vulnerability is a server-side code execution flaw in CMSimple 5.22's CoAuthors plugin content import functionality. The vulnerability stems from insecure evaluation of imported content—the server improperly processes and executes code embedded in imported text files without proper sanitization or validation. An authenticated low-privileged user with page content modification permissions can upload a crafted text file containing malicious PHP/scripting code and reference it through the content import feature, triggering server-side evaluation. Attack preconditions include valid authentication and page editing capabilities. Successful exploitation allows arbitrary command execution with the privileges of the web server process, enabling complete system compromise. Patch availability has not been confirmed in the advisory.
Affected products
- CMSimple CMSimple 5.22
Timeline
- 2026-09-08: disclosed: CVE-2026-78834 published
- 2026-06-21: other: Vulnerability reported on GitHub