CVE-2026-39169: SEMCMS 5

Synopsis

An unauthorized access vulnerability exists in SEMCMS 5.0, specifically in the SEMCMS_copy.php component. The flaw is reachable over the network without any authentication required, meaning any internet-accessible deployment is exposed. Successful exploitation gives an attacker read access to sensitive data handled by the affected endpoint, with no impact on data integrity or service availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the service via HTTP/HTTPS from any internet-accessible vantage point.

• AuthenticationNot required

  No credentials or session token of any kind are needed to trigger the unauthorized access condition.

• Victim interactionNot required

  The attacker sends a direct request to the vulnerable endpoint; no user action or social engineering is required.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions, memory-layout dependencies, or special environmental factors required.

Blast Radius

• A successful attacker reads confidential data exposed through SEMCMS_copy.php, which may include application content, configuration values, or user records stored in the CMS.
• Confidentiality of the affected data is fully compromised (CVSS C:H); the attacker gains the same read access as a legitimate internal user of that endpoint.
• Data integrity is not affected; the attacker cannot modify or delete records through this vulnerability.
• Service availability is not affected; the application continues running normally after exploitation.