CVE-2026-28495: RCE in massiveAdmin GetSimple CMS

This vulnerability allows an attacker to execute arbitrary code on the web server with the privileges of the administrator account. Successful exploitation grants the attacker full control over the affected system, enabling them to steal sensitive data, modify website content, install malware, or pivot to other systems on the network. The lack of CSRF protection significantly lowers the barrier to entry, as an attacker can leverage existing administrator sessions to execute malicious code without requiring further authentication. This is a high-impact vulnerability with the potential for widespread damage, similar to other configuration file overwrite vulnerabilities that have led to complete system compromise.

1. Reserved2026-02-27
2. Published2026-03-10
3. EPSS updated2026-03-23

The primary mitigation is to upgrade to a patched version of GetSimpleCMS-CE that includes a fixed version of the massiveAdmin plugin. Unfortunately, a specific fixed version is not yet available. As a temporary workaround, implement strict CSRF protection on the gsconfig editor module. This can be achieved by adding a CSRF token to the form and validating it on submission. Additionally, consider restricting access to the gsconfig editor module to trusted administrators only. Monitor gsconfig.php for unauthorized modifications. After upgrade, confirm by attempting to access the gsconfig editor as an administrator and verifying that the form now includes a CSRF token.