CVE-2026-55695criticalCWE-94

CVE-2026-55695: critical vulnerability in fearlessgeekmedia FearlessCMS

FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater

Published

Follow this CVE+ Monitor FearlessCMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.5%
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
fearlessgeekmedia · FearlessCMS
Related CVEs — fearlessgeekmedia FearlessCMS

In the same product, most dangerous first.

CVE-2026-63190CRITICALFearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSSEPSS 0.5%