Quick.CMS flaws enable DoS, file disclosure
Three vulnerabilities in OpenSolution Quick.CMS let admins (or CSRF-tricked admins) delete the primary language, cause DoS, or read arbitrary server files.
Sourcecert.pl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of three vulnerabilities in OpenSolution Quick.CMS, discovered by researcher Karol Czubernat. CVE-2026-63301 stems from a missing server-side authorization check on the language-deletion API endpoint; while the admin UI hides the option to delete the primary language, a direct API call can still perform the deletion, causing a denial of service. This flaw becomes more severe when chained with a separate CSRF vulnerability (CVE-2026-1468), allowing an unauthenticated attacker to trigger the DoS by luring an authenticated administrator to click a malicious link, removing the need for direct application access.
Two further issues affect authenticated admin users: CVE-2026-63302 is a Local File Inclusion vulnerability in admin.php via the 'p' parameter, permitting inclusion of arbitrary application files and disclosure of server directory structure and absolute paths. CVE-2026-63303 is a path traversal flaw in URI handling that fails to normalize '../' sequences, letting an admin-level attacker read files outside the webroot. Only version 6.8 was tested, but all versions are considered potentially affected.
The vendor assessed exploitation likelihood as very low and has not committed to releasing fixes, meaning these issues will likely remain unpatched. Given the requirement for administrator-level access for two of the three issues, and the vendor's own low-risk assessment, the practical exploitation risk is limited, though the CSRF-chained DoS scenario extends the attack surface to unauthenticated actors targeting logged-in admins.
Mentioned in this report
Detection guidance
Quick.CMS Direct API Call to Delete Primary Language (DoS)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a direct HTTP request to the Quick.CMS admin API that deletes a language entry, bypassing the UI safeguard that hides this option for the primary/default language and causing application-wide denial of service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.CMS Direct API Call to Delete Primary Language (DoS)
description: Detects direct calls to the Quick.CMS language-management endpoint requesting
deletion, which can remove the primary language and take the CMS offline. The admin
UI hides this option for the default language, but the underlying endpoint performs
no server-side authorization check, so it can be invoked directly or via a CSRF-forged
request from an authenticated admin's browser.
tags:
- attack.impact
- attack.t1499
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: admin.php
cs-uri-query|contains:
- language
- lang
action_delete:
cs-uri-query|contains:
- delete
- remove
condition: selection and action_delete
falsepositives:
- Legitimate administrator intentionally removing a secondary (non-primary) language
through normal admin workflow
- Automated CMS configuration/migration scripts that manage language sets
level: medium
id: 9f0b3153-31be-5b4b-aebe-0065ef02c2ee
status: experimental
author: Vorant
Quick.CMS admin.php Local File Inclusion via p Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects requests to Quick.CMS admin.php where the 'p' parameter contains path traversal or wrapper sequences, indicative of exploitation of the LFI flaw (CVE-2026-63302) to include arbitrary application files and disclose server paths. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.CMS admin.php Local File Inclusion via p Parameter
description: Detects HTTP requests to Quick.CMS's admin.php script where the 'p' parameter
includes path traversal sequences, absolute paths, or stream wrapper prefixes, consistent
with exploitation of the unauthenticated-file-inclusion flaw that lets an authenticated
admin include arbitrary files and leak directory structure.
tags:
- attack.discovery
- attack.t1083
- attack.collection
- attack.t1005
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: admin.php
cs-uri-query|contains: p=
suspicious_value:
cs-uri-query|contains:
- ../
- ..%2f
- ..\\
- php://
- /etc/
- C:\\
condition: selection and suspicious_value
falsepositives:
- Legitimate 'p' parameter values that happen to contain slash-separated module names
resembling traversal (rare, review encoding)
- Security scanning/pentest tools probing the same parameter
level: high
id: 4548ea89-5075-56f8-a6f1-c4e9c7f3e7db
status: experimental
author: Vorant
Quick.CMS Path Traversal in URI Requesting Files Outside Webroot
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing unnormalized '../' traversal sequences in the URI path, matching the Quick.CMS path-traversal flaw (CVE-2026-63303) that allows an admin-level attacker to read files outside the webroot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.CMS Path Traversal in URI Requesting Files Outside Webroot
description: Detects raw or encoded directory traversal sequences in the request URI
path/stem, consistent with exploitation of Quick.CMS's URI handling flaw that fails
to normalize '../' sequences, enabling disclosure of files outside the intended
webroot.
tags:
- attack.collection
- attack.t1005
- attack.discovery
- attack.t1083
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- ../
- ..%2f
- ..%2F
- '%2e%2e/'
- ..\\
filter_static_assets:
cs-uri-stem|contains:
- /themes/
- /templates/
condition: selection and not filter_static_assets
falsepositives:
- Legitimate theme/template asset loaders that use relative parent-directory references
(should be scoped by filter)
- Vulnerability scanners or pentest tools probing traversal payloads
level: medium
id: d6d04556-740f-5c6c-b2bf-934681432130
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-63301
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs