{"id":"CVE-2026-78834","title":"A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin","summary":"A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing cra…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94"],"published":"2026-09-08","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:04:24.933","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78834","references":[{"url":"https://gist.github.com/AEQ3/574cb644306776a9ff1a0de30b085e62","label":"cve@mitre.org"},{"url":"https://github.com/AEQ3/CVE/issues/1","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T13:05:22.526332Z"},"ingestedAt":"2026-09-08T21:11:12.320Z","epss":0.00666,"epssPercentile":0.4965,"slug":"CVE-2026-78834","body":"## Overview\n\nA code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected content import feature.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201944,"id":"CVE-2026-78834","ts":1789399993192,"field":"cvss","old":null,"new":"8.8"},{"seq":201943,"id":"CVE-2026-78834","ts":1789399993192,"field":"severity","old":"none","new":"high"},{"seq":200674,"id":"CVE-2026-78834","ts":1789397585325,"field":"cvss","old":"8.8","new":null},{"seq":200673,"id":"CVE-2026-78834","ts":1789397585325,"field":"severity","old":"high","new":"none"},{"seq":199381,"id":"CVE-2026-78834","ts":1789395475365,"field":"cvss","old":null,"new":"8.8"},{"seq":199380,"id":"CVE-2026-78834","ts":1789395475365,"field":"severity","old":"none","new":"high"},{"seq":198626,"id":"CVE-2026-78834","ts":1789392188059,"field":"cvss","old":"8.8","new":null},{"seq":198625,"id":"CVE-2026-78834","ts":1789392188059,"field":"severity","old":"high","new":"none"},{"seq":196957,"id":"CVE-2026-78834","ts":1789384272995,"field":"cvss","old":null,"new":"8.8"},{"seq":196956,"id":"CVE-2026-78834","ts":1789384272995,"field":"severity","old":"none","new":"high"},{"seq":194088,"id":"CVE-2026-78834","ts":1789378693701,"field":"cvss","old":"8.8","new":null},{"seq":194087,"id":"CVE-2026-78834","ts":1789378693701,"field":"severity","old":"high","new":"none"},{"seq":192875,"id":"CVE-2026-78834","ts":1789376494282,"field":"cvss","old":null,"new":"8.8"},{"seq":192874,"id":"CVE-2026-78834","ts":1789376494282,"field":"severity","old":"none","new":"high"},{"seq":191662,"id":"CVE-2026-78834","ts":1789373590247,"field":"cvss","old":"8.8","new":null},{"seq":191661,"id":"CVE-2026-78834","ts":1789373590247,"field":"severity","old":"high","new":"none"},{"seq":190447,"id":"CVE-2026-78834","ts":1789369449343,"field":"cvss","old":null,"new":"8.8"},{"seq":190446,"id":"CVE-2026-78834","ts":1789369449343,"field":"severity","old":"none","new":"high"},{"seq":189234,"id":"CVE-2026-78834","ts":1789368373278,"field":"cvss","old":"8.8","new":null},{"seq":189233,"id":"CVE-2026-78834","ts":1789368373278,"field":"severity","old":"high","new":"none"},{"seq":188017,"id":"CVE-2026-78834","ts":1789365211352,"field":"cvss","old":null,"new":"8.8"},{"seq":188016,"id":"CVE-2026-78834","ts":1789365211352,"field":"severity","old":"none","new":"high"},{"seq":186804,"id":"CVE-2026-78834","ts":1789363454819,"field":"cvss","old":"8.8","new":null},{"seq":186803,"id":"CVE-2026-78834","ts":1789363454819,"field":"severity","old":"high","new":"none"},{"seq":185590,"id":"CVE-2026-78834","ts":1789361195077,"field":"cvss","old":null,"new":"8.8"},{"seq":185589,"id":"CVE-2026-78834","ts":1789361195077,"field":"severity","old":"none","new":"high"},{"seq":184377,"id":"CVE-2026-78834","ts":1789358318803,"field":"cvss","old":"8.8","new":null},{"seq":184376,"id":"CVE-2026-78834","ts":1789358318803,"field":"severity","old":"high","new":"none"},{"seq":182628,"id":"CVE-2026-78834","ts":1789354302421,"field":"cvss","old":null,"new":"8.8"},{"seq":182627,"id":"CVE-2026-78834","ts":1789354302421,"field":"severity","old":"none","new":"high"},{"seq":181421,"id":"CVE-2026-78834","ts":1789353279900,"field":"cvss","old":"8.8","new":null},{"seq":181420,"id":"CVE-2026-78834","ts":1789353279900,"field":"severity","old":"high","new":"none"},{"seq":180214,"id":"CVE-2026-78834","ts":1789350265228,"field":"cvss","old":null,"new":"8.8"},{"seq":180213,"id":"CVE-2026-78834","ts":1789350265228,"field":"severity","old":"none","new":"high"},{"seq":179007,"id":"CVE-2026-78834","ts":1789348256839,"field":"cvss","old":"8.8","new":null},{"seq":179006,"id":"CVE-2026-78834","ts":1789348256839,"field":"severity","old":"high","new":"none"},{"seq":177800,"id":"CVE-2026-78834","ts":1789346355746,"field":"cvss","old":null,"new":"8.8"},{"seq":177799,"id":"CVE-2026-78834","ts":1789346355746,"field":"severity","old":"none","new":"high"},{"seq":176593,"id":"CVE-2026-78834","ts":1789343156611,"field":"cvss","old":"8.8","new":null},{"seq":176592,"id":"CVE-2026-78834","ts":1789343156611,"field":"severity","old":"high","new":"none"},{"seq":174710,"id":"CVE-2026-78834","ts":1789334852903,"field":"cvss","old":null,"new":"8.8"},{"seq":174709,"id":"CVE-2026-78834","ts":1789334852903,"field":"severity","old":"none","new":"high"},{"seq":173505,"id":"CVE-2026-78834","ts":1789333641097,"field":"cvss","old":"8.8","new":null},{"seq":173504,"id":"CVE-2026-78834","ts":1789333641097,"field":"severity","old":"high","new":"none"},{"seq":172319,"id":"CVE-2026-78834","ts":1789331080370,"field":"cvss","old":null,"new":"8.8"},{"seq":172318,"id":"CVE-2026-78834","ts":1789331080370,"field":"severity","old":"none","new":"high"},{"seq":171133,"id":"CVE-2026-78834","ts":1789328750642,"field":"cvss","old":"8.8","new":null},{"seq":171132,"id":"CVE-2026-78834","ts":1789328750642,"field":"severity","old":"high","new":"none"},{"seq":169928,"id":"CVE-2026-78834","ts":1789327144365,"field":"cvss","old":null,"new":"8.8"},{"seq":169927,"id":"CVE-2026-78834","ts":1789327144365,"field":"severity","old":"none","new":"high"}]}