FearlessCMS 0.1.2b Update Mechanism Allows Remote Code Execution
Admins can force the system to clone attacker-controlled Git repos, replacing core files and executing arbitrary PHP code on the server.
Key points
- CVE-2026-55695 is rated critical with a CVSS score of 9.1.
- The flaw exists in versions of FearlessCMS prior to 0.1.3b.
- Attackers can replace plugin and admin directories with malicious PHP files.
An authenticated administrator account in FearlessCMS versions before 0.1.3b can trigger remote code execution through the software's update mechanism. The vulnerability, tracked as CVE-2026-55695, carries a critical severity rating of 9.1 from the National Vulnerability Database. This flaw allows an attacker who has gained administrative access to replace core application directories with malicious content, effectively turning the content management system into a persistent backdoor.
Root cause
The issue stems from how the updater-handler.php script processes repository URLs. An administrator can specify an arbitrary Git repository address, which the system then passes to the update.sh shell script. The updater clones this external repository and overwrites the live plugins, admin, and includes directories. The system performs no verification of the repository's identity, digital signatures, or file contents during this process.
Attack path
Because the router.php component permits the execution of existing PHP files located within the plugins directory, any malicious PHP code included in the cloned repository will run immediately. This execution occurs with the privileges of the web server process. The attacker-supplied content persists on the disk, allowing continued remote code execution even after the initial update trigger completes.
Affected versions
- FearlessCMS version 0.1.2b
- All versions of FearlessCMS earlier than 0.1.3b
Mitigation
- Upgrade FearlessCMS to version 0.1.3b or later.
- Restrict administrative access to trusted networks only.
- Monitor the plugins, admin, and includes directories for unexpected changes.
- Implement file integrity monitoring on critical CMS directories.
Signals worth monitoring
Teams usually detect this type of compromise by observing unexpected Git clone operations or shell script executions originating from the web server process. Security operations should check web server logs for requests to updater-handler.php that originate from unusual IP addresses or contain suspicious URL parameters. File integrity monitoring alerts for rapid changes in the plugins or admin directories are strong indicators. Incident responders should isolate affected servers immediately and verify the source of recent updates.
What to do and how to stay safe: FearlessCMS
- Verify your current FearlessCMS version and upgrade to 0.1.3b if you are running 0.1.2b or earlier.
- Review administrative access logs to identify any unauthorized update attempts or suspicious login activity.
- Scan the plugins, admin, and includes directories for unknown or modified PHP files that do not belong to the official distribution.
- Once the vendor provides an update, apply it promptly and monitor for any residual malicious files that may have been planted during the attack.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is tracked as CVE-2026-55695.
Which versions of FearlessCMS are affected?
Version 0.1.2b and all earlier versions are affected.
Is there a fix available?
Yes, the issue is fixed in version 0.1.3b.
