GetSimple CMS Community Edition depends on .htaccess files to block anonymous access to sensitive directories such as /data/ and /backups/. When Apache’s AllowOverride is disabled—a common setting in hardened or shared hosting environments—the rules in those .htaccess files are ignored. As a result, unauthenticated users can enumerate and download files including authorization.xml, which stores cryptographic salts and API keys. This satisfies CWE‑200, allowing attackers to obtain credentials that could be used for further compromise.

All released versions of GetSimple CMS Community Edition are affected. The vulnerability manifests on any installation where the web server runs Apache with AllowOverride turned off for the directories that contain sensitive data. It does not require any specific software version or patch state; every build is vulnerable until configuration changes or an official fix is applied.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1%, suggesting that exploitation is currently rare but still possible. The vulnerability does not appear in the CISA KEV catalog. Attackers can exploit the weakness remotely by accessing URLs that map to the protected directories; because the .htaccess protections are silently bypassed, a simple file request can reveal sensitive data. No public exploit has yet been released, and no official patch exists at the time of this report.