A path traversal flaw exists in the UserGuide Module XML Import component of CMS Made Simple, allowing an attacker to specify arbitrary file paths during the import process. The flaw is triggered remotely and permits writing or reading files outside the intended directory tree. Exploitation could enable an attacker to overwrite critical files, inject malicious code, or expose sensitive data, potentially leading to full system compromise.

CMS Made Simple users running version 2.2.22 or earlier are affected. The vulnerability is in the UserGuide Module located at modules/UserGuide/lib/class.UserGuideImporterExporter.php. The issue has been acknowledged and patched in the next release, so systems on versions newer than 2.2.22 are not vulnerable.

The CVSS base score of 5.1 reflects a moderate severity, and the public nature of the exploit indicates it can be leveraged remotely with no local privileges. EPSS data is unavailable and the vulnerability is not currently tracked in the CISA KEV catalog. Attackers would likely exploit the flaw by triggering an XML import request with a crafted file path, causing the server to write files in arbitrary locations. As the flaw can be triggered over the network, the risk to exposed installations is significant until the patch is applied.