CVE-2026-63190: FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

Severity: critical (CVSS 9.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-29
Weakness: CWE-22

Description

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.

Summary

FearlessCMS before 0.1.4 ships five debug/test PHP scripts under admin/ that skip isLoggedIn() checks, CSRF protection and path validation. On PHP's built-in server (including the default Docker setup), a /./admin/ URI bypasses the login gate, letting unauthenticated attackers write arbitrary .md files, read directories and files, and inject stored or reflected JavaScript, with impact amplified when PHP runs as root. No exploitation in the wild is reported and the flaw is not in CISA KEV. Upgrade to 0.1.4 or later; if you cannot, block /./admin/ and the debug scripts at the proxy or web server and avoid running PHP as root.

تعاني FearlessCMS قبل الإصدار 0.1.4 من خمسة سكربتات PHP للتشخيص والاختبار داخل admin/ تتجاوز فحص isLoggedIn() وحماية CSRF والتحقق من المسار. على خادم PHP المدمج (بما في ذلك نشر Docker الافتراضي)، يتيح مسار /./admin/ تجاوز بوابة تسجيل الدخول، فيستطيع مهاجم غير مصادق كتابة ملفات .md عشوائية وقراءة المجلدات والملفات وحقن JavaScript مخزّن أو منعكس، ويتضاعف الأثر عندما يعمل PHP بصلاحيات root. لا توجد تقارير عن استغلال فعلي، وCVE-2026-63190 غير مدرج في CISA KEV. رقّوا إلى الإصدار 0.1.4 أو أحدث؛ وإن تعذر ذلك فاحجبوا /./admin/ وسكربتات التشخيص على مستوى الخادم الوكيل أو خادم الويب وتجنبوا تشغيل PHP بصلاحيات root.

Affected products

fearlessgeekmedia FearlessCMS: before 0.1.4

References

Get alerted when CVE-2026-63190 or the next vulnerability affects your stack