CVE-2026-30461 is an authenticated remote code execution vulnerability affecting Daylight Studio FuelCMS v1.5.2. The flaw exists in the /controllers/Installer.php file within the add_git_submodule function, allowing an attacker with valid credentials and limited privileges to execute arbitrary commands remotely. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS 3.1 base score is 8.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. No patch or official remediation level has been published, and no known exploits have been reported.

Successful exploitation could allow an authenticated attacker to execute arbitrary code on the affected system, potentially leading to full system compromise or unauthorized actions. The confidentiality and integrity of the system are highly impacted, while availability impact is low. Since the vulnerability requires authentication with privileges, the attack surface is limited to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Installer.php controller and the add_git_submodule function to trusted users only. Monitor for vendor updates and apply patches promptly once released.