CVE-2026-63302 in Quick.CMS
Summary
by MITRE • 07/28/2026
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure).
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
Local File Inclusion vulnerabilities represent a critical class of security flaws that allow attackers to read arbitrary files from the target system through manipulation of file path parameters. The Quick.CMS vulnerability exists within the admin.php endpoint where the p parameter accepts user-supplied input without proper sanitization or validation. This flaw falls under CWE-22 which specifically addresses improper limitation of a pathname to a restricted directory, commonly known as Path Traversal attacks. When an authenticated administrator submits a malicious request containing crafted file path references, the application processes these inputs directly within its file inclusion mechanisms.
The technical execution of this vulnerability requires an attacker to already possess administrative credentials, which significantly reduces the attack surface but does not eliminate the risk entirely. The exploitation process typically involves constructing specially formatted paths that traverse the directory structure to access sensitive files such as configuration files, database credentials, or system files. In this case, the vulnerability specifically enables path disclosure, meaning attackers can determine the absolute file paths used by the application on the server filesystem. This information proves valuable for further exploitation attempts as it reveals the underlying directory structure and potentially exposes other vulnerabilities through detailed path knowledge.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with critical system intelligence that could facilitate more sophisticated attacks. Path disclosure can reveal the exact location of sensitive files, application architecture patterns, and system configuration details that attackers might leverage for privilege escalation or additional exploitation vectors. The vendor's assessment of very low likelihood of exploitation reflects their confidence in the limited attack surface due to the requirement for administrative access, but this assessment may be overly optimistic given that many organizations have complex permission structures where compromised admin credentials might not be immediately detected.
Security professionals should consider implementing multiple layers of protection against such vulnerabilities through proper input validation, sanitization, and the principle of least privilege. The ATT&CK framework categorizes this type of vulnerability under T1059 Command and Scripting Interpreter and T1566 Credential Access, highlighting how path traversal attacks can be used to escalate privileges and gain unauthorized access to sensitive information. Organizations should implement strict file inclusion controls by using allowlists of acceptable files, implementing proper input validation that rejects suspicious path sequences, and ensuring that administrative access is tightly controlled through multi-factor authentication and regular privilege reviews. Regular security assessments and code reviews focusing on file handling functions can help identify similar vulnerabilities across the application stack and prevent exploitation attempts before they occur.