{"id":"CVE-2026-63190","published":"2026-10-28T20:18:37Z","modified":"2026-10-29T19:17:25Z","title":"FearlessCMS is a flat-file `content` management system centered on simplicity and open source","vendor":"fearlessgeekmedia","product":"FearlessCMS","tier":"core","eol":null,"description":{"text":"FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.","provenance":"source","from":"NVD"},"summary":null,"cvss":{"score":9.4,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.00544,"percentile":0.45682,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Known_Cve | Oct 31, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae4af06a3790b65a9afe87a","created":"2026-10-30"},{"name":"Known_Cve | Oct 30, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ae35d945cba1d70e2bf3a79","created":"2026-10-29"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"},{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/commit/59fb22cf989b5ba14c387c3212e15b146e02cf9a","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-3mq8-hrhf-7hv6","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/tree/0.1.4","tags":[]},{"url":"https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-3mq8-hrhf-7hv6","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-112405","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112405","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63190","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":16.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.14,"detail":"percentile 0.4568"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.58,"detail":"base score 9.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}