CVE-2026-63302: Quick.CMS Path Traversal Vulnerability

CVE-2026-63302 Overview

CVE-2026-63302 is a Local File Inclusion (LFI) vulnerability in Quick.CMS, affecting the admin.php endpoint through the p parameter. An authenticated attacker with administrative privileges can craft HTTP requests that include arbitrary files from within the application's directory structure. Successful exploitation reveals the server's directory structure and absolute file paths, enabling path disclosure that supports further reconnaissance.

The issue is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The vendor assessed the exploitation likelihood as very low and has determined a fix is not necessary.

Critical Impact
Authenticated administrators can enumerate server file paths and directory structure through crafted requests to admin.php, aiding post-exploitation reconnaissance.

Affected Products

Quick.CMS by OpenSolution
admin.php endpoint processing the p parameter
Deployments where administrative access has been granted to untrusted users

Discovery Timeline

2026-07-28 - CVE-2026-63302 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-63302

Vulnerability Analysis

Quick.CMS accepts a p parameter in admin.php and uses its value to construct a file path passed to a PHP include or require operation. The application does not adequately restrict the parameter value to an allowlist of expected controller identifiers. An attacker who authenticates as an administrator can supply path values that resolve to arbitrary files within the application's directory tree.

Because PHP surfaces filesystem errors and warnings when an include target cannot be located or interpreted, the resulting error messages leak absolute file paths and directory names. This is classic path disclosure derived from an LFI primitive. The vulnerability is limited by the precondition that the attacker already holds administrator credentials, which reduces the practical exposure of most deployments.

Root Cause

The root cause is improper control of filename input for a PHP include/require statement, mapped to [CWE-98]. The p parameter is treated as a trusted controller selector rather than as untrusted input requiring strict validation against a fixed set of allowed values.

Attack Vector

Exploitation requires network access to the Quick.CMS administrative interface and valid administrator credentials. The attacker sends a crafted HTTP request to admin.php with a manipulated p parameter. The response, or the resulting PHP error output, discloses filesystem paths and application directory layout. No user interaction is required beyond the attacker's own request. The scope is limited to information disclosure; the vendor advisory does not describe code execution outcomes from this specific issue.

See the CERT Poland CVE Analysis and OpenSolution Security Resources for additional context.

Detection Methods for CVE-2026-63302

Indicators of Compromise

Requests to admin.php with unusual p parameter values containing path separators, dot segments, or file extensions such as .php, .inc, or .log.
HTTP responses from admin.php that include absolute filesystem paths in PHP warnings or error output.
Administrator sessions that iterate through many distinct p parameter values in a short window, suggesting enumeration.

Detection Strategies

Inspect web server and PHP error logs for include(), require(), or fopen() warnings referencing paths derived from the p parameter.
Baseline the legitimate set of p values used by Quick.CMS controllers and alert on any request supplying a value outside that set.
Correlate authenticated admin sessions with anomalous parameter fuzzing patterns using web application firewall (WAF) or reverse proxy logs.

Monitoring Recommendations

Forward Quick.CMS web server, PHP-FPM, and application logs to a centralized logging platform for retention and query.
Alert on repeated 500-class responses or PHP warning strings emitted from the admin.php endpoint.
Track authentication events for administrator accounts and review sessions that generate abnormal parameter distributions.

How to Mitigate CVE-2026-63302

Immediate Actions Required

Restrict access to the Quick.CMS administrative interface to trusted networks or VPN-only reachability.
Enforce strong, unique credentials and multi-factor authentication for all administrator accounts to raise the precondition bar for exploitation.
Disable verbose PHP error output in production by setting display_errors = Off so that path disclosure via warnings is suppressed.
Review administrator account inventory and remove any accounts that do not require ongoing access.

Patch Information

The vendor has assessed the likelihood of exploitation as very low and stated that a fix is not necessary. No official patch is available. Operators should treat mitigations as compensating controls rather than a substitute for a vendor fix. Monitor the OpenSolution Security Resources page for any change in the vendor's position.

Workarounds

Add a WAF rule that rejects requests to admin.php where the p parameter contains ../, absolute paths, or characters outside an allowlist of expected controller names.
Configure PHP with open_basedir restricted to the Quick.CMS installation directory to limit the filesystem scope reachable through include statements.
Ensure log_errors = On with display_errors = Off so operators retain diagnostic data without leaking it to HTTP clients.
Audit administrator activity regularly and rotate credentials for any account showing signs of enumeration.

bash

# Example PHP hardening for Quick.CMS deployments
# /etc/php/php.ini or a site-specific ini file
display_errors = Off
log_errors = On
error_log = /var/log/php/quickcms-error.log
open_basedir = /var/www/quickcms:/tmp
expose_php = Off