Zero Radar
← feed
CriticalVulnerabilityCVE-2026-63190updated 28 Oct 2026, 20:22 UTC

FearlessCMS lets anyone edit site files and run debug scripts without logging in

Attackers can reach hidden debug pages in this flat-file website system without logging in. They can read and overwrite site content, inject malicious scripts into pages that visitors and admins see, and fill up the server's disk.

Fixed in Version 0.1.4Official source
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 0.1.4 · since 28 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestUses /./admin/ path to skip login
  2. 2Debug script runsNo authentication or CSRF check
  3. 3Files read or writtenPath traversal reaches any .md file
  4. 4Script planted in pageStored XSS runs for admins who view it
  5. ResultSite defaced or admin sessions stolen

What happened

Prior to version 0.1.4, five debug/test PHP scripts under admin/ lack authentication, CSRF protection and path validation. On PHP's built-in development server (including the default Docker deployment), a dot-segment URL such as /./admin/ bypasses the admin login gate in router.php. The scripts allow arbitrary .md file writes (including path traversal outside content/), arbitrary directory listing and file reads, reflected and stored XSS, and unauthenticated log/file growth.

Why it is dangerous: Attackers can deface the site, plant scripts that steal administrator sessions, and read sensitive server information such as file paths and permissions. Because the tested deployment runs PHP as root, file damage can be severe.

Are you affected?

You are affected if you run FearlessCMS before version 0.1.4, especially on PHP's built-in development server or the default Docker deployment.

FearlessCMS versions prior to 0.1.4

What to do

  1. Update FearlessCMS to version 0.1.4 or later
  2. If you cannot update now, do not expose the admin/ directory or the PHP development server to the internet
  3. Check the content/ folder and admin/testdebug.log for unexpected files or changes
  4. Review admin sessions and change admin passwords if you suspect misuse

Timeline

  1. 28 Oct 2026, 20:18 UTC
    Publicly disclosed
  2. 28 Oct 2026, 20:18 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 20:22 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-63190
CVSS
9.4 / 10
Disclosed
28 Oct 2026, 20:18 UTC
On Zero Radar
28 Oct 2026, 20:22 UTC (4 min after disclosure)
Last change
28 Oct 2026, 20:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

FearlessCMS lets anyone edit site files and run debug scripts without logging in · Zero Radar