CVE-2021-47734

CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution

CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.

Affected

Cmsimple · CMSimple

CVSS v4.0 VULNCHECK

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.78% chance of exploitation in the next 30 days, 55th percentile

Published

2025-12-23

Updated

2026-03-17

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/50547

Security advisories

• https://www.vulncheck.com/advisories/cmsimple-authenticated-local-file-inclusion-remote-c…
• https://www.cmsimple.org/en

References

• CVE Record
• NVD entry