FearlessCMS: Unauthenticated debug scripts allow file access, writes and XSS
Summary
Five debug and test PHP scripts in the admin/ directory of FearlessCMS perform file operations without authentication, CSRF protection or path validation. On the PHP built-in development server, including the default Docker setup, an unauthenticated attacker can bypass the admin login using the URI prefix /./admin/. Attackers can read directory listings and .md files, write or traverse-write .md files, and inject stored and reflected JavaScript, which can steal administrator sessions. The scripts run with PHP's privileges, which the tested deployment ran as root.
Affected
- FearlessCMS versions before 0.1.4 (CNA range; the GitHub advisory lists up to 0.1.2b)
- Particularly relevant on the PHP built-in development server and the default Docker deployment
Fixed in
- Version 0.1.4 (commit 59fb22cf989b5ba14c387c3212e15b146e02cf9a)
- Whether a backport to 0.1.3.x exists: Unknown.
Workaround
- No workaround documented by the vendor.
- Restrict access to the admin/ path at a reverse proxy or firewall until the upgrade is done.
- Do not run the site on the PHP built-in development server or the default Docker setup.
Exploitation
- CISA SSVC: exploitation status poc, automatable yes, technical impact total.
- No confirmed exploitation in the wild; not listed in CISA KEV.
- Public PoC status conflicting and unverified.
Our recommendation
- Upgrade to FearlessCMS 0.1.4 immediately if the instance is reachable from the internet.
- Until the upgrade, take the instance offline or restrict admin paths to trusted networks.
- Run PHP as a non-root user.
- Check whether admin/debug_content.php, admin/debug_save_flow.php, admin/preview-handler.php, admin/testdebug.php and admin/test_redirect.php exist and remove them.
- Review web server logs for requests containing /./admin and check content/ and admin/testdebug.log for unexpected files or growth.
- Note that the upstream repository is archived; plan a migration if no maintained fork appears.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-63190 Strix record www.strix.ai
- GitHub Security Advisory GHSA-3mq8-hrhf-7hv6 github.com
- Fixing commit 59fb22c github.com
- FearlessCMS tag 0.1.4 github.com
- VulDB entry 428198 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- TheHackerWire CVE-2026-63190 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:41.
Original description (NVD)
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.
NVD references (4)
- https://github.com/fearlessgeekmedia/FearlessCMS/commit/59fb22cf989b5ba14c387c3212e15b146e02cf9a
- https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-3mq8-hrhf-7hv6
- https://github.com/fearlessgeekmedia/FearlessCMS/tree/0.1.4
- https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-3mq8-hrhf-7hv6
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.