FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
Impact
FearlessCMS versions prior to 0.1.4 have unauthenticated debug scripts that expose filesystem operations and cross-site scripting. An attacker can bypass the admin login and execute scripts directly, allowing arbitrary file writes and reads. This can lead to site defacement, stored JavaScript execution, and exposure of sensitive information.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
fearlessgeekmedia · GitHub_M
FearlessCMS
1 range
fearlessgeekmedia · GitHub_M
FearlessCMS
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 0.1.4
Other versions: unknown
Original source description
FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn() authentication checks, CSRF protection or adequate path validation. On PHP's built-in development server, including the default Docker deployment, router.php checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so /./admin/ bypasses the admin login gate and executes those scripts directly. In admin/debug_save_flow.php, attacker-controlled path and content reach file_put_contents for arbitrary .md writes under content/ or outside it through path traversal, enabling site defacement and stored JavaScript in public pages; print_r($_POST) output without htmlspecialchars escaping also causes reflected cross-site scripting. The admin/debug_content.php path parameter reaches scandir(), file_get_contents() and posix_getpwuid(), permitting arbitrary directory enumeration and .md file reads that expose absolute paths, ownership, permissions, hashes and content previews. The admin/preview-handler.php endpoint accepts JSON content and title and writes enumerable files under content/_preview/, enabling stored cross-site scripting and disk exhaustion. The admin/testdebug.php endpoint appends to admin/testdebug.log without authentication, also enabling disk exhaustion. The admin/test_redirect.php script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected content. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-63190View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-63190
Observed 2026-10-29T18:54:14.977Z · upstream updated 2026-10-29T18:35:51.109Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-29T18:35:27.307607Z", "decisions": [ { "name": "Exploitation", "value": "poc" }, { "name": "Automatable", "value": "yes" }, { "name": "Technical Impact", "value": "total" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.