CVE-2026-5203

Tuesday, March 31, 2026

5.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Summary

A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This issue has been reported early to the project. They confirmed, that "this has already been discovered and fixed for the next release."

Affected Software

Vendor	Product	Version Range	Status
n/a	CMS Made Simple	`2.2.0`	affected
n/a	CMS Made Simple	`2.2.1`	affected
n/a	CMS Made Simple	`2.2.2`	affected
n/a	CMS Made Simple	`2.2.3`	affected
n/a	CMS Made Simple	`2.2.4`	affected
n/a	CMS Made Simple	`2.2.5`	affected
n/a	CMS Made Simple	`2.2.6`	affected
n/a	CMS Made Simple	`2.2.7`	affected
n/a	CMS Made Simple	`2.2.8`	affected
n/a	CMS Made Simple	`2.2.9`	affected
n/a	CMS Made Simple	`2.2.10`	affected
n/a	CMS Made Simple	`2.2.11`	affected
n/a	CMS Made Simple	`2.2.12`	affected
n/a	CMS Made Simple	`2.2.13`	affected
n/a	CMS Made Simple	`2.2.14`	affected
n/a	CMS Made Simple	`2.2.15`	affected
n/a	CMS Made Simple	`2.2.16`	affected
n/a	CMS Made Simple	`2.2.17`	affected
n/a	CMS Made Simple	`2.2.18`	affected
n/a	CMS Made Simple	`2.2.19`	affected
n/a	CMS Made Simple	`2.2.20`	affected
n/a	CMS Made Simple	`2.2.21`	affected
n/a	CMS Made Simple	`2.2.22`	affected

Weaknesses

CWE-22: Path Traversal

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: no
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.