PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53952 GetSimpleCMS-CE CVE debrief

CVE-2026-53952 debrief based on the supplied source corpus. The CVE record was published on 2026-09-11T20:17:14.060Z and has not been modified since then. This critical vulnerability in GetSimple CMS and GetSimple CMS CE allows unauthenticated attackers to create new administrator accounts due to a logic flaw. Affected versions include GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below). The flaw is caused by a self-exclusion bug in the deletion logic of the `admin/setup.php` file, which remains accessible even after a legitimate installation is completed.

Vendor
GetSimpleCMS-CE
Product
GetSimpleCMS-CE
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Defenders responsible for GetSimple CMS and GetSimple CMS CE installations, particularly those with versions 3.4.0a and below, and 3.3.22 and below, respectively, should assess exposure and verify the integrity of the `admin/setup.php` file.

Why it matters

CVE-2026-53952 is a critical vulnerability in GetSimple CMS and GetSimple CMS CE that allows unauthenticated attackers to create new administrator accounts. Defenders should prioritize verifying exposure, assessing the integrity of the `admin/setup.php` file, and upgrading to patched versions if available.

  • Potential creation of unauthorized administrator accounts.
  • Possible elevation of privileges for attackers.
  • Risk of further exploitation or malicious activity.
  • Need for verification of `admin/setup.php` file integrity.

Technical summary

A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account due to a self-exclusion bug in the deletion logic of the `admin/setup.php` file. This bug neutralizes an automated security control designed to delete the sensitive `admin/setup.php` file post-installation, leaving it accessible for unauthorized account creation even after a legitimate installation is completed. Defenders should prioritize verifying exposure of GetSimple CMS and GetSimple CMS CE installations and assess the integrity of the `admin/setup.php` file.

Defensive priority

Defenders should prioritize verifying exposure of GetSimple CMS and GetSimple CMS CE installations, particularly versions 3.4.0a and below, and 3.3.22 and below, respectively, and assess the integrity of the `admin/setup.php` file.

Recommended defensive actions

  • Verify exposure of GetSimple CMS and GetSimple CMS CE installations, particularly versions 3.4.0a and below, and 3.3.22 and below, respectively.
  • Assess the integrity of the `admin/setup.php` file.
  • Delete or secure the `admin/setup.php` file if it exists.
  • Upgrade to a patched version if available.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on a logic flaw in GetSimple CMS and GetSimple CMS CE that allows unauthenticated attackers to create a new administrator account due to a self-exclusion bug in the deletion logic of the `admin/setup.php` file.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53952 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53952

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53952 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53952

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.