CVE-2026-55695: FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FearlessCMSto a version that resolves this vulnerability.Fixed in 0.1.3b
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated FearlessCMS administrator can exploit it. The attacker needs access to the updater endpoint and the ability to invoke the update operation with a repository URL they control.
Which deployments are affected?
FearlessCMS versions 0.1.2b and earlier are affected. Version 0.1.3b fixes the issue.
What access does successful exploitation provide?
A malicious update can replace live plugin, admin, and include directories with attacker-controlled content. Attacker-supplied PHP can then execute with the web server process's privileges and remain as a persistent backdoor.
How can I determine whether a system may already be compromised?
Review the configured update repository URL and updater activity for unexpected repositories or update operations. Inspect the live plugins/, admin/, and includes/ directories for unrecognized or modified PHP files, especially content introduced through an update.
What should be done if upgrading cannot happen immediately?
Restrict authenticated administrator access and prevent use of the system updater until version 0.1.3b can be deployed. Review and restore the live plugins/, admin/, and includes/ directories from a trusted source if an untrusted update repository may have been used.