GetSimple CMS lacks CSRF protection on the administrative file upload endpoint, enabling an attacker to silently trigger a file upload from an authenticated user's browser via a crafted malicious webpage. When an authenticated administrator loads an attacker‑controlled page, the browser submits a file upload request that the CMS accepts without requiring a CSRF token or origin check. The upload accepts any file type, so an attacker could place executable scripts or other malicious payloads on the server, potentially leading to remote code execution or other severe consequences if the uploaded file is served or executed by the CMS. The vulnerability stems from a lack of anti‑CSRF controls and insufficient file‑type validation, classified as CWE‑352 and CWE‑434.

All versions of the GetSimpleCMS‑CE Community Edition are affected.

The CVSS score of 7.1 indicates a high severity, and the extremely low EPSS score (<1%) suggests that exploitation is unlikely to be widespread at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the victim is logged in as an administrator and visits a page controlled by an attacker; the attack path is purely CSRF‑based and does not involve any authentication or additional preconditions beyond an active session.