CVE-2026-63302
Local File Inclusion in Quick.CMS
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jul 28, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jul 16, 2026
Description
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure).
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CERT-PL |
Weaknesses
- CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected Products
| Product | Versions |
|---|---|
Quick.CMSOpenSolution |
|
References
- https://cert.pl/en/posts/2026/07/CVE-2026-63301third-party-advisory
- https://opensolution.org/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.