---
id: CVE-2026-5203
title: A vulnerability was found in CMS Made Simple up to 2.2.22
summary: >-
  A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the
  function _copyFilesToFolder in the library
  modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component
  UserGuide Module XML Import. The manipulati…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-22
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5203'
references:
  - url: 'https://drive.proton.me/urls/Q0JHZ339BW#X9P2G3Guwvwa'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/772855'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/354331'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/354331/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - exploit-available
epss: 0.00461
epssPercentile: 0.37257
ingestedAt: '2026-07-24T20:38:02.695Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/CaginKyr/CVE-2026-5203'
  checkedAt: '2026-09-25T08:21:01.662Z'
exploitAvailable: true
---

## Overview

A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML Import. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This issue has been reported early to the project. They confirmed, that "this has already been discovered and fixed for the next release."

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.