CVE-2025-48492: GetSimple CMS RCE in Edit component

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-30 · updated 2026-06-17
Weakness: CWE-77

Description

GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code Execution (RCE). This issue is set to be patched in version 3.3.22.

Affected products

GetSimpleCMS-CE: from 3.3.16 before 3.3.22 — fixed in 3.3.22

How to fix

Upgrade to a fixed version: GetSimpleCMS-CE 3.3.22. Check the vendor advisory for mitigations.

References

https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-g435-p72m-p582
https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-g435-p72m-p582

Get alerted when CVE-2025-48492 or the next vulnerability affects your stack