CVE-2026-63190: FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn() authentication checks, CSRF protection or adequate path validation. On PHP's built-in development server, including the default Docker deployment, router.php checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so /./admin/ bypasses the admin login gate and executes those scripts directly. In admin/debugsaveflow.php, attacker-controlled path and content reach fileputcontents for arbitrary .md writes under content/ or outside it through path traversal, enabling site defacement and stored JavaScript in public pages; printr($POST) output without htmlspecialchars escaping also causes reflected cross-site scripting. The admin/debugcontent.php path parameter reaches scandir(), filegetcontents() and posixgetpwuid(), permitting arbitrary directory enumeration and .md file reads that expose absolute paths, ownership, permissions, hashes and content previews. The admin/preview-handler.php endpoint accepts JSON content and title and writes enumerable files under content/preview/, enabling stored cross-site scripting and disk exhaustion. The admin/testdebug.php endpoint appends to admin/testdebug.log without authentication, also enabling disk exhaustion. The admin/testredirect.php script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected content. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FearlessCMSto a version that resolves this vulnerability.Fixed in 0.1.4
Event History
Frequently Asked Questions
Which deployments are exposed to the unauthenticated admin-script access?
FearlessCMS versions before 0.1.4 are affected when run with PHP's built-in development server, including the default Docker deployment. The bypass relies on router.php checking an unnormalized admin URI while filesystem resolution processes dot segments such as /./admin/.
What does an attacker need to exploit this issue?
No authentication, privileges, or user interaction are required. An attacker can send requests to the exposed debug and test scripts under admin/ and control relevant path and content parameters.
What impact can exploitation have?
An attacker can write arbitrary .md files under content/ or use path traversal to write outside it, enabling site defacement and stored JavaScript in public pages. They can also enumerate directories and read .md files, exposing filesystem paths, ownership, permissions, hashes, and content previews; reflected XSS is possible through unescaped POST data.
How can I determine whether my instance is affected?
Check whether the installed FearlessCMS version is earlier than 0.1.4 and whether it is served through PHP's built-in development server or the default Docker deployment. Also verify whether requests using an /./admin/ path reach admin debug or test scripts without an authenticated session.