FearlessCMS: Remote code execution via unvalidated updater repository URL
Summary
FearlessCMS is a flat-file content management system. An authenticated administrator can set an arbitrary Git repository URL in the built-in updater, which clones it and replaces the live plugins/, admin/ and includes/ directories without verifying identity, signatures or contents. Because the PHP development server router executes existing PHP files under plugins/, attacker-supplied code can run with web server privileges and persist as a backdoor.
Affected
- FearlessCMS 0.1.2b and earlier
- Versions before 0.1.3b are listed as affected by the CNA; one source names 0.1.3a as the upper bound, so treat 0.1.3a and earlier as affected
- Fresh installations are in scope
Fixed in
- Fixed in FearlessCMS 0.1.3b (per vendor advisory)
- Newer release 0.1.4b or higher is available; the repository is archived and read-only
Workaround
- Restrict access to /admin to trusted IP ranges or a VPN
- Enforce MFA on admin accounts and review admin accounts
- Do not run the PHP built-in development server in production
- Disable or remove the updater feature if it is not needed
- Monitor plugins/, admin/ and includes/ for unexpected PHP files and compare them with a known-good copy
Exploitation
- No confirmed exploitation in the wild found
- CISA KEV status not confirmed; check the CISA catalog directly
- Public proof of concept: unclear
- Attacker needs administrator rights (PR:H); CISA SSVC lists exploitation as PoC and automatable as no
Our recommendation
- Inventory all FearlessCMS installations, including Docker images
- Upgrade to 0.1.4b or higher, which also covers the separate critical CVE-2026-63190
- Until patched, restrict admin access and check for unexpected PHP files in plugins/, admin/ and includes/
- Rotate admin credentials and database secrets on any internet-exposed instance that was not patched
- Check whether the upstream project is still maintained, since the repository is archived
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-56wm-3q3v-m93m github.com
- Fix commit 6dba91d github.com
- Release 0.1.3 github.com
- Pull Request #64 github.com
- OSV entry CVE-2026-55695 osv.dev
- Strix CVE-2026-55695 www.strix.ai
- VulDB 417775 vuldb.com
- VulDB 428198 (CVE-2026-63190) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:46.
Original description (NVD)
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
NVD references (5)
- https://github.com/fearlessgeekmedia/FearlessCMS/commit/6dba91d496463e3940a2c917af3cae97b191de92
- https://github.com/fearlessgeekmedia/FearlessCMS/pull/64
- https://github.com/fearlessgeekmedia/FearlessCMS/releases/tag/0.1.3
- https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m
- https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-56wm-3q3v-m93m
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.