Vulnerability in FearlessCMS Enables Arbitrary Code Execution via Git Repository URL

CVE-2026-55695

What is CVE-2026-55695?

FearlessCMS, a flat-file content management system, is susceptible to a significant vulnerability where authenticated administrators can set arbitrary Git repository URLs via admin/updater-handler.php. The execute method performs an update that lacks adequate verification of the repository's identity, allowing attackers to potentially clone malicious repositories. This vulnerability enables an attacker to replace core directories, such as plugins/, admin/, and includes/, with attacker-controlled contents, which could include executing arbitrary PHP scripts with the privileges of the web server process. This security flaw has been addressed in version 0.1.3b of FearlessCMS.

References