Medium severity · published Mar 31, 2026
CVE-2026-5203
CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This issue has been reported early to the project. They confirmed, that "this has already been discovered and fixed for the next release."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMS Made Simple · Cms Made Simple
2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +17 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5203
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5203
drive.proton.me
https://drive.proton.me/urls/Q0JHZ339BW#X9P2G3Guwvwa
vuldb.com
https://vuldb.com/submit/772855
vuldb.com
https://vuldb.com/vuln/354331
vuldb.com
https://vuldb.com/vuln/354331/cti
More from CMS Made Simple
8.8
CVE-2024-1527
Unrestricted Upload of File with Dangerous Type in CMS Made Simple
6.1
CVE-2024-1529
Cross-site Scripting in CMS Made Simple
6.1
CVE-2024-1528
Cross-site Scripting in CMS Made Simple
2.4
CVE-2026-4225
CMS Made Simple User Management listusers.php cross site scripting
–
CVE-2008-2267
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by…