Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-27147

GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG files via the administrative upload functionality, but they are not properly sanitized or restricted, allowing an attacker to embed malicious JavaScript. When the uploaded SVG file is accessed, the script executes in the browser. This issue does not have a fix at the time of publication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GetSimpleCMS-CE GetSimpleCMS-CE

  • <= 3.3.22affected

References