CVE-2026-63302 | Quick.CMS is vulnerable to Local File Inclusion (LFI) in the… | CVSS 5.1 MEDIUM

Description

Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure). The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

Metadata

CVE ID: CVE-2026-63302
State: PUBLISHED
Assigner: CERT-PL
Reserved: 2026-07-16 10:27 UTC
Published: 2026-07-28 10:43 UTC
Last updated: 2026-07-28 12:26 UTC
Primary CWE: CWE-98
CWE-98 Improper Control of Filename for Include/Require Stat…
Vendor / Product: OpenSolution / Quick.CMS
Sources: cve.org · NVD

Severity & Metrics

5.1 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
OpenSolution	Quick.CMS	—	0 ≤ 6.8.0

Weakness (CWE)

CWE	Source	Description
CWE-98	cna	CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.1	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References (2)