All vulnerabilities
CVE-2026-55695GHSA-56wm-3q3v-m93m

FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater

fearlessgeekmedia FearlessCMS
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.46%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.1.3bFixed versionGitHub
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 0.1.3bfearlessgeek/fearlesscms, composerGitHubcomposer require "fearlessgeek/fearlesscms:^0.1.3b"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.

Text from CVE List

Affected versions 2

  • FearlessCMSaffected: < 0.1.3bCVE List
  • fearlessgeek/fearlesscms, composer≤ 0.1.2bGitHub

References 4