{"id":"CVE-2026-55695","published":"2026-10-13T16:17:22.057","lastModified":"2026-10-16T20:04:29.760","description":"FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/commit/6dba91d496463e3940a2c917af3cae97b191de92","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/pull/64","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/releases/tag/0.1.3","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m","tags":[]}],"exploitRefs":[{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/commit/6dba91d496463e3940a2c917af3cae97b191de92","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/pull/64","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/releases/tag/0.1.3","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated administrator can trigger arbitrary code execution by uploading malicious Git repositories that get executed as PHP files through the web server, allowing attackers to establish persistent backdoors with web server privileges.","exploitability":"Exploitation requires an authenticated admin account and is relatively straightforward once access is gained, as it involves setting a Git repository URL and triggering an update process.","blast_radius":"The impact could be severe across all affected FearlessCMS installations, potentially allowing attackers to gain full control of web applications and persistently maintain access through backdoor PHP files.","remediation":"Upgrade to version 0.1.3b immediately to address this vulnerability.","detection":"Monitor for unusual Git repository URL settings in admin/updater-handler.php and check for newly created or modified PHP files in plugins/, admin/, and includes/ directories that could indicate backdoor persistence.","tags":["rce","web","privilege-escalation","git"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:56:18.132Z"}}