CVE-2026-70650: GetSimple CMS Stored XSS Vulnerability

CVE-2026-70650 Overview

CVE-2026-70650 is an authenticated stored Cross-Site Scripting (XSS) vulnerability in GetSimple CMS CE, the community edition of the GetSimple content management system. The flaw resides in the page backup viewer (admin/backup-edit.php) in versions 3.3.22 and prior. Page fields are properly HTML-encoded on save, but the backup viewer decodes them again through htmldecode() and strip_decode() before rendering, without re-escaping. An authenticated page editor can inject JavaScript into Keywords, Description, Menu text, or Content fields. The payload executes in the browser of any administrator who later opens that page's backup, running in the admin control panel context.

Critical Impact
Stored XSS enables account takeover of higher-privileged administrators viewing a page backup, leading to full CMS compromise.

Affected Products

GetSimple CMS CE 3.3.22
GetSimple CMS CE versions prior to 3.3.22
The admin/backup-edit.php component specifically

Discovery Timeline

2026-10-01 - CVE-2026-70650 published to the National Vulnerability Database
2026-10-05 - Entry last updated in the NVD database

Technical Details for CVE-2026-70650

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified as [CWE-79]. GetSimple CMS CE encodes page metadata correctly when writing content to backup files on disk. The failure occurs on retrieval. The backup viewer at admin/backup-edit.php decodes stored values back into raw HTML through the htmldecode() and strip_decode() helpers, then emits the output into the administrator interface without reapplying output escaping.

Any JavaScript stored in Keywords, Description, Menu text, or Content fields executes when an administrator opens the affected backup. The script runs with full session privileges in the admin control panel. Attackers can create new administrator accounts, exfiltrate session cookies, modify published pages, or pivot to further CMS actions. At the time of publication, no official patch is available from the GetSimple CMS CE project.

Root Cause

The root cause is improper output encoding during the decode-and-render path. Input sanitization at write time is undone at read time, violating the principle of contextual output escaping. Because htmldecode() and strip_decode() strip the protective encoding before the data reaches the HTML sink, previously-neutralized payloads become executable script.

Attack Vector

Exploitation requires an authenticated low-privilege page editor account. The attacker edits a page and places a JavaScript payload in any of the vulnerable fields. When a higher-privileged administrator later opens the backup for that page through the backup viewer, the payload fires in their session context. The attack vector is network-based, requires low complexity, and needs no additional user interaction beyond opening the backup entry. See the GitHub Security Advisory GHSA-p6vf-2xr7-mcf4 for technical details.

Detection Methods for CVE-2026-70650

Indicators of Compromise

Page records containing <script>, onerror=, onload=, or javascript: strings in Keywords, Description, Menu text, or Content fields.
Backup files under the GetSimple /backups/pages/ directory containing encoded HTML entities that decode to executable script.
Unexpected administrator account creations or role changes following access to admin/backup-edit.php.

Detection Strategies

Scan the page database and backup directory for stored payloads using regex pattern matching for common XSS vectors.
Review web server access logs for GET requests to admin/backup-edit.php correlated with low-privilege editor sessions preceding administrator visits.
Monitor outbound HTTP requests from administrator browsers to unfamiliar domains, which may indicate cookie exfiltration.

Monitoring Recommendations

Alert on new user accounts created shortly after admin/backup-edit.php is accessed.
Track content changes in page metadata fields by non-administrator roles.
Enable Content Security Policy (CSP) reporting to capture inline script execution attempts in the admin panel.

How to Mitigate CVE-2026-70650

Immediate Actions Required

Restrict access to admin/backup-edit.php at the web server or reverse proxy layer until a patch is released.
Audit all existing pages and backup files for suspicious payloads in Keywords, Description, Menu text, and Content fields.
Limit page editor accounts to trusted users and review role assignments.
Rotate administrator session cookies and credentials if backup files contain unverified content.

Patch Information

At the time of publication, no official patch is available for GetSimple CMS CE 3.3.22 or earlier. Administrators should monitor the GetSimple CMS CE repository and the GitHub Security Advisory GHSA-p6vf-2xr7-mcf4 for updates.

Workarounds

Disable or remove the admin/backup-edit.php script where backup review is not operationally required.
Deploy a Web Application Firewall (WAF) rule to block requests to the backup viewer or inspect responses for script tags.
Enforce a strict Content Security Policy on the admin interface that disallows inline scripts.
Operate the GetSimple admin panel on a separate hostname to reduce the blast radius of session theft.

bash

# Example Apache restriction for admin/backup-edit.php
<Files "backup-edit.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>

# Example Content Security Policy header for the admin panel
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"