CVE-2026-55695 Details
Description
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
A remote code execution vulnerability has been identified in FearlessCMS versions through 0.1.2b. The issue arises in the system updater, where an authenticated administrator can set an arbitrary Git repository URL without any validation. When the update is triggered, the CMS clones the repository and replaces core directories with the downloaded content. This process does not verify the repository's identity or the integrity of the files, allowing attacker-supplied PHP code to be executed with the web server's privileges. The vulnerability is further exacerbated by the PHP development server's routing behavior, which permits the execution of PHP files in certain directories, effectively turning the injected code into a persistent backdoor.
Users can upgrade to FearlessCMS version 0.1.3b or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/fearlessgeekmedia/FearlessCMS/commit/6dba91d496463e3940a2c917af3cae97b191de92 | [email protected] | Source CodeVendor |
| https://github.com/fearlessgeekmedia/FearlessCMS/pull/64 | [email protected] | Issue TrackingVendor |
| https://github.com/fearlessgeekmedia/FearlessCMS/releases/tag/0.1.3 | [email protected] | Release NotesVendor |
| https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FearlessCMS | <= 0.1.2b |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |