CVE-2026-63303

UNKNOWN 0.0

Path Traversal in Quick.CMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

CWE	CWE-23
Vendor	opensolution
Product	quick.cms
Published	Jul 28, 2026
Last Updated	Jul 28, 2026

Stay Ahead of the Next One

Get instant alerts for opensolution quick.cms

Be the first to know when new unknown vulnerabilities affecting opensolution quick.cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

OpenSolution / Quick.CMS

0 ≤ 6.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/en/posts/2026/07/CVE-2026-63301 opensolution.org: https://opensolution.org/

Credits

Karol Czubernat