CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure). The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/07/CVE-2026-63301
https://opensolution.org/

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Quick.CMS es vulnerable a Inclusión local de ficheros (LFI) en el endpoint admin.php a través del parámetro p. Un atacante autenticado con privilegios de administrador puede incluir ficheros arbitrarios ubicados dentro de la estructura de directorios de la aplicación a través de una solicitud HTTP manipulada. La explotación exitosa permite la divulgación de la estructura de directorios del servidor y las rutas de ficheros absolutas (divulgación de rutas). El proveedor evaluó la probabilidad de explotación como muy baja y determinó que una solución no es necesaria.

Information

Published : 2026-07-28 11:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-63302

Mitre link : CVE-2026-63302

CVE.ORG link : CVE-2026-63302

JSON object : View

Products Affected

No product.

CWE

CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

{"id": "CVE-2026-63302", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63302", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T12:21:45.884105Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "OpenSolution", "product": "Quick.CMS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.8.0"}], "defaultStatus": "unknown"}]}], "published": "2026-07-28T11:17:03.963", "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-63301", "source": "cvd@cert.pl"}, {"url": "https://opensolution.org/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-98"}]}], "descriptions": [{"lang": "en", "value": "Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure).\n\n\n\nThe vendor assessed the likelihood of exploitation as very low and determined that a fix is\u00a0not necessary."}, {"lang": "es", "value": "Quick.CMS es vulnerable a Inclusi\u00f3n local de ficheros (LFI) en el endpoint admin.php a trav\u00e9s del par\u00e1metro p. Un atacante autenticado con privilegios de administrador puede incluir ficheros arbitrarios ubicados dentro de la estructura de directorios de la aplicaci\u00f3n a trav\u00e9s de una solicitud HTTP manipulada. La explotaci\u00f3n exitosa permite la divulgaci\u00f3n de la estructura de directorios del servidor y las rutas de ficheros absolutas (divulgaci\u00f3n de rutas).\n\nEl proveedor evalu\u00f3 la probabilidad de explotaci\u00f3n como muy baja y determin\u00f3 que una soluci\u00f3n no es necesaria."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cvd@cert.pl"}