CVE-2026-30461 is an authenticated remote code execution vulnerability in Daylight Studio FuelCMS v1.5.2. The issue exists in the /controllers/Installer.php file, specifically in the add_git_submodule function. An attacker with authenticated access can exploit this vulnerability to execute arbitrary code remotely. The vulnerability is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.1 base score is 8.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity with low impact on availability. There is no vendor advisory or patch available at this time.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the affected system, potentially leading to full system compromise. The high CVSS score reflects significant confidentiality and integrity impact, with limited availability impact. This could result in unauthorized access, data manipulation, or system control by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Installer.php controller and limit authenticated user privileges to trusted personnel only. Monitor for unusual activity related to the add_git_submodule function and consider disabling or restricting this functionality if feasible.