CVE-2026-55695 in FearlessCMS
Summary
by MITRE • 10/13/2026
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
FearlessCMS operates as a flat-file content management system designed for simplicity and open-source accessibility, relying on file-based storage rather than traditional database architectures. Within versions up to 0.1.2b, the application contains a critical security flaw in its update mechanism that allows an authenticated administrator to compromise the entire server environment. The vulnerability resides specifically within the admin/updater-handler.php script, which serves as the entry point for initiating system updates via the perform_update function. This function accepts a Git repository URL provided by the user and passes it directly to an external shell script named update.sh without performing any validation or sanitization of the input source.
The core technical flaw is a lack of integrity verification during the cloning process. When the updater executes, it clones the specified Git repository and proceeds to overwrite critical system directories including plugins/, admin/, and includes/ with the contents retrieved from that remote source. The application fails to verify the identity of the repository owner, check for cryptographic signatures such as GPG tags, or inspect the actual code contained within the repository before deployment. This design decision assumes that any Git repository provided by an authenticated user is safe, ignoring the reality that attackers can easily create malicious repositories containing backdoors or web shells disguised as legitimate plugins.
The operational impact of this vulnerability is severe due to how FearlessCMS handles file execution through its router.php component. The routing logic permits existing PHP files located within the plugins directory to be executed by the underlying PHP development server. Consequently, once an attacker supplies a malicious repository containing crafted PHP scripts and triggers the update process, these scripts are written directly into the live environment. Because the web server runs with specific privileges, the injected code executes with those same permissions, allowing for arbitrary command execution on the host system. This effectively grants the attacker full control over the application and potentially the underlying operating system if file permissions allow further escalation or access to sensitive data stored by the CMS.
This vulnerability aligns closely with CWE-20 Improper Input Validation, as the system fails to validate external input before using it in a security-critical operation. It also relates to CWE-94 Code Injection and CWE-78 OS Command Injection due to the execution of untrusted code within the server context. From an ATT&CK perspective, this behavior facilitates Initial Access through valid credentials followed by Execution via command or script interpretation, and Persistence as the malicious files remain in the plugins directory even after the initial exploit is triggered. The attacker can maintain long-term access by ensuring their backdoor scripts are preserved during subsequent updates or system restarts.
To mitigate this risk, organizations running FearlessCMS must immediately upgrade to version 0.1.3b where these issues have been addressed. In addition to upgrading, administrators should enforce strict input validation on all parameters passed to update handlers and implement signature verification for any external code sources before deployment. It is also advisable to restrict the execution permissions of PHP files in directories that do not require direct web access and to monitor file integrity changes within critical system folders such as plugins and admin using intrusion detection systems or file integrity monitoring tools.