Quick.CMS flaws enable DoS, file disclosure

Three vulnerabilities in OpenSolution Quick.CMS let admins (or CSRF-tricked admins) delete the primary language, cause DoS, or read arbitrary server files.

CERT Polska coordinated disclosure of three vulnerabilities in OpenSolution Quick.CMS, discovered by researcher Karol Czubernat. CVE-2026-63301 stems from a missing server-side authorization check on the language-deletion API endpoint; while the admin UI hides the option to delete the primary language, a direct API call can still perform the deletion, causing a denial of service. This flaw becomes more severe when chained with a separate CSRF vulnerability (CVE-2026-1468), allowing an unauthenticated attacker to trigger the DoS by luring an authenticated administrator to click a malicious link, removing the need for direct application access.

Two further issues affect authenticated admin users: CVE-2026-63302 is a Local File Inclusion vulnerability in admin.php via the 'p' parameter, permitting inclusion of arbitrary application files and disclosure of server directory structure and absolute paths. CVE-2026-63303 is a path traversal flaw in URI handling that fails to normalize '../' sequences, letting an admin-level attacker read files outside the webroot. Only version 6.8 was tested, but all versions are considered potentially affected.

The vendor assessed exploitation likelihood as very low and has not committed to releasing fixes, meaning these issues will likely remain unpatched. Given the requirement for administrator-level access for two of the three issues, and the vendor's own low-risk assessment, the practical exploitation risk is limited, though the CSRF-chained DoS scenario extends the attack surface to unauthenticated actors targeting logged-in admins.

title: Quick.CMS Direct API Call to Delete Primary Language (DoS)
description: Detects direct calls to the Quick.CMS language-management endpoint requesting
  deletion, which can remove the primary language and take the CMS offline. The admin
  UI hides this option for the default language, but the underlying endpoint performs
  no server-side authorization check, so it can be invoked directly or via a CSRF-forged
  request from an authenticated admin's browser.
tags:
- attack.impact
- attack.t1499
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: admin.php
    cs-uri-query|contains:
    - language
    - lang
  action_delete:
    cs-uri-query|contains:
    - delete
    - remove
  condition: selection and action_delete
falsepositives:
- Legitimate administrator intentionally removing a secondary (non-primary) language
  through normal admin workflow
- Automated CMS configuration/migration scripts that manage language sets
level: medium
id: 9f0b3153-31be-5b4b-aebe-0065ef02c2ee
status: experimental
author: Vorant

title: Quick.CMS admin.php Local File Inclusion via p Parameter
description: Detects HTTP requests to Quick.CMS's admin.php script where the 'p' parameter
  includes path traversal sequences, absolute paths, or stream wrapper prefixes, consistent
  with exploitation of the unauthenticated-file-inclusion flaw that lets an authenticated
  admin include arbitrary files and leak directory structure.
tags:
- attack.discovery
- attack.t1083
- attack.collection
- attack.t1005
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: admin.php
    cs-uri-query|contains: p=
  suspicious_value:
    cs-uri-query|contains:
    - ../
    - ..%2f
    - ..\\
    - php://
    - /etc/
    - C:\\
  condition: selection and suspicious_value
falsepositives:
- Legitimate 'p' parameter values that happen to contain slash-separated module names
  resembling traversal (rare, review encoding)
- Security scanning/pentest tools probing the same parameter
level: high
id: 4548ea89-5075-56f8-a6f1-c4e9c7f3e7db
status: experimental
author: Vorant

title: Quick.CMS Path Traversal in URI Requesting Files Outside Webroot
description: Detects raw or encoded directory traversal sequences in the request URI
  path/stem, consistent with exploitation of Quick.CMS's URI handling flaw that fails
  to normalize '../' sequences, enabling disclosure of files outside the intended
  webroot.
tags:
- attack.collection
- attack.t1005
- attack.discovery
- attack.t1083
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - ../
    - ..%2f
    - ..%2F
    - '%2e%2e/'
    - ..\\
  filter_static_assets:
    cs-uri-stem|contains:
    - /themes/
    - /templates/
  condition: selection and not filter_static_assets
falsepositives:
- Legitimate theme/template asset loaders that use relative parent-directory references
  (should be scoped by filter)
- Vulnerability scanners or pentest tools probing traversal payloads
level: medium
id: d6d04556-740f-5c6c-b2bf-934681432130
status: experimental
author: Vorant

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-63301