CVE-2024-1527 is a critical (CVSS 9.8) unrestricted file upload in CMS Made Simple version 2.2.14. An authenticated user can bypass the upload protections and potentially place a webshell, leading to command execution on the server. The record names no fixed version, so check the vendor and INCIBE notice.
What's affected
The record names CMS Made Simple 2.2.14 as affected. It does not name a fixed version. The only reference is a notice from INCIBE-CERT on multiple vulnerabilities in the product, which I could not retrieve.
Because the record gives only one version, treat later releases as unconfirmed until the project's release notes say the upload check was fixed. The attacker must be authenticated, so the account model of your site matters. The record's score is still 9.8, because it assumes the weakest authentication case in its metrics.
How to check if you're exposed
Find the version in the CMS Made Simple admin console, which shows it on the home page and in the footer. You can also read it from the installation's version file in the web root.
Then list who has login accounts that can reach the upload feature, and look in the uploads directory for files with executable extensions such as php. Any script in an uploads folder should be treated as suspicious.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the installed CMS Made Simple version.
- Upgrade to a release newer than 2.2.14 after checking the project's release notes.
- Configure the web server so the uploads directory cannot run scripts.
- Audit user accounts and remove any you do not recognise.
- Search the uploads directory for unexpected script files and investigate any you find.
Why it matters
The record classes this as CWE-434, unrestricted upload of a file with a dangerous type. The upload code checked what it was given in a way that could be bypassed, so a script could be stored where the server would run it.
Once a webshell exists, the attacker has the rights of the web server user. That means reading configuration files and database credentials, and moving on from there. Blocking script execution in upload folders limits the damage even when a validation check fails. The record's KEV flag is false.
Quick check
Does it need a login?
Yes. The record describes an authenticated user.
What is a webshell?
A script placed on a server that lets someone run commands through the web server.
Sources
Last reviewed: 19 October 2026.
