GetSimple CMS Arbitrary File Read Vulnerability in Uploaded Files Feature

A vulnerability allowing arbitrary file reads has been identified in all versions of GetSimple CMS, specifically within the Uploaded Files feature. At the time of publication, this issue had not been addressed.

Impact

Exploitation of this vulnerability leads to unauthorized access to the system's core confidential data, causing a significant security breach.

Reproduction

To reproduce this vulnerability, upload a file through the application's file upload feature. Once the file is uploaded, navigate to the file's URL within the 'data/uploads' directory. The uploaded file can be accessed directly, bypassing any intended restrictions.