CVE-2026-55695: CWE-94: Improper Control of Generation of Code ('Code Injection') in fearlessgeekmedia FearlessCMS
Description
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
CVSS v3.1
Score 9.1critical
Affected software
fearlessgeekmedia
FearlessCMS
pkg:github/fearlessgeekmedia/FearlessCMSRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FearlessCMS, a flat-file CMS, in versions 0.1.2b and earlier, allows an authenticated administrator to set an arbitrary Git repository URL via admin/updater-handler.php and trigger an update process that clones the repository and replaces live plugin, admin, and include directories without verifying the repository's identity or contents. Because router.php executes existing PHP files under plugins, attacker-supplied code can execute with web server privileges, leading to arbitrary code execution and persistent backdoors. This vulnerability is identified as CWE-94 (Improper Control of Generation of Code) and has a CVSS 3.1 score of 9.1 (critical). The vulnerability is fixed in version 0.1.3b.
Potential Impact
Successful exploitation allows an authenticated administrator to execute arbitrary PHP code with the privileges of the web server process, resulting in full compromise of the CMS installation including persistent backdoors. This can lead to complete system compromise, data theft, or further attacks on the hosting environment.
Mitigation Recommendations
Upgrade FearlessCMS to version 0.1.3b or later, where this vulnerability is fixed. Do not rely on untrusted Git repository URLs for updates. Since the vulnerability requires authenticated administrator access, ensure strong access controls and authentication mechanisms are in place.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T00:13:10.650Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ace567b2cdf04f65683952c
Added to database: 10/13/2026, 16:04:11 UTC
Last enriched: 10/13/2026, 16:18:25 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.