CVE-2026-55695
FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
| CWE | CWE-94 |
| Vendor | fearlessgeekmedia |
| Product | fearlesscms |
| Published | Oct 13, 2026 |
| Last Updated | Oct 13, 2026 |
Get instant alerts for fearlessgeekmedia fearlesscms
Be the first to know when new critical vulnerabilities affecting fearlessgeekmedia fearlesscms are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H