Privileged Operations Flaw in FearlessCMS Flat-File Content Management System

CVE-2026-63190

What is CVE-2026-63190?

FearlessCMS, a simplistic flat-file content management system, contains multiple vulnerabilities that allow attackers to perform unauthorized privileged operations. Prior to version 0.1.4, five debug and test PHP scripts in the /admin/ directory lack essential security checks such as user authentication and CSRF protection. This failure enables direct execution of these scripts from unverified URIs. An attacker could exploit this issue to perform path traversal attacks to write files arbitrarily within the content directory or elsewhere, leading to potential site defacement or the injection of malicious scripts into public pages. Furthermore, the vulnerable components permit directory enumeration and file reading, risking exposure of sensitive server details. Given that the tested deployment runs PHP with root privileges, the impact of these vulnerabilities is significantly exacerbated, highlighting the need for immediate updates to version 0.1.4 or later.

References