Description
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure).



The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Published: 2026-07-28
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Quick.CMS is vulnerable to Local File Inclusion via the p parameter in the admin.php endpoint. This flaw, categorized as CWE-98, allows an attacker with administrator privileges to include arbitrary files located within the application’s directory. Successful exploitation is limited to disclosure of the server’s directory structure and absolute file paths; it does not grant code execution or broader system compromise.

Affected Systems

The impacted product is Quick.CMS from OpenSolution. No specific version information is provided for the affected releases.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate impact, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated admin credentials, and the vendor has assessed the likelihood as very low, stating that a fix is not necessary at this time.

Generated by OpenCVE AI on August 3, 2026 at 15:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict access to the admin.php endpoint so that only essential administrators have credentials, and employ network segmentation to limit exposure.
  • Implement input validation or sanitization for the p parameter, such as a whitelist of allowable file names or disallowing directory traversal characters.
  • Configure PHP's open_basedir setting to restrict file inclusion to the application’s intended directories and prevent arbitrary file access.

Generated by OpenCVE AI on August 3, 2026 at 15:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Opensolution
Opensolution quick.cms
Vendors & Products Opensolution
Opensolution quick.cms

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure). The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Title Local File Inclusion in Quick.CMS
Weaknesses CWE-98
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Opensolution Quick.cms
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-28T12:26:32.768Z

Reserved: 2026-07-16T10:27:23.339Z

Link: CVE-2026-63302

cve-icon Vulnrichment

Updated: 2026-07-28T12:26:28.201Z

cve-icon NVD

Status : Deferred

Published: 2026-07-28T11:17:03.963

Modified: 2026-07-30T16:29:42.347

Link: CVE-2026-63302

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T15:15:04Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')