| CVE ID | CVE-2026-63301 |
| Publication date | 28 July 2026 |
| Vendor | OpenSolution |
| Product | Quick.CMS |
| Vulnerable versions | All through 6.8.0 |
| Vulnerability type (CWE) | Client-Side Enforcement of Server-Side Security (CWE-602) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-63302 |
| Publication date | 28 July 2026 |
| Vendor | OpenSolution |
| Product | Quick.CMS |
| Vulnerable versions | All through 6.8.0 |
| Vulnerability type (CWE) | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-63303 |
| Publication date | 28 July 2026 |
| Vendor | OpenSolution |
| Product | Quick.CMS |
| Vulnerable versions | All through 6.8.0 |
| Vulnerability type (CWE) | Relative path traversal (CWE-23) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerabilities in OpenSolution Quick.CMS software and participated in coordination of their disclosure.
The vulnerability CVE-2026-63301: In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application.
Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application
The vulnerability CVE-2026-63302: Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure).
The vulnerability CVE-2026-63303: A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI.
Only version 6.8 was tested but all versions should be considered as vulnerable. The vendor assessed the likelihood of exploitation of all above vulnerabilities as very low and determined that fixes are not necessary.
Credits
We thank Karol Czubernat for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.