Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Debug PHP scripts under the `admin/` directory in FearlessCMS perform privileged actions without proper login and CSRF checks. Insufficient path validation allows attackers to bypass the login gate using crafted admin URI prefixes (e.g., `/./admin/`). Authenticated-path traversal enables writing arbitrary `.md` files containing stored JavaScript, arbitrary file and directory enumeration and reads via `scandir()` and `file_get_contents()`. The vulnerability also enables stored XSS attacks and disk exhaustion through preview and log-writing endpoints.
An unauthenticated attacker can bypass the login gate using path normalization techniques to access debug scripts, then write arbitrary Markdown files with embedded JavaScript, read any file on the disk via directory enumeration and file read functions, trigger stored XSS attacks, and exhaust disk space through log and preview endpoints.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
No patch information available
Upgrade FearlessCMS to version 0.1.4 or later. Implement proper authentication and CSRF token validation for all admin endpoints. Apply strict path canonicalization to prevent bypass techniques using path traversal sequences. Restrict access to debug scripts and disable them in production environments. Implement input validation and sanitization for file operations to prevent arbitrary file writes. Apply output encoding to prevent stored XSS vulnerabilities. Implement rate limiting on file operations and log writing to mitigate disk exhaustion attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Feedly found the first article mentioning CVE-2026-63190 . See article
NVD published the first details for CVE-2026-63190
A CVSS base score of 9.4 has been assigned.
Links to Mitre Att&cks
CVE-2026-118579: A weakness has been identified in D-Link DIR-505 1
CVE-2026-117574: AI Gateway API Key Injection Enables Cross-Tenant LLM Resource Consumption
Privileged Operations Flaw in FearlessCMS Flat-File Content Management System
CVE-2026-63190: FearlessCMS is a flat-file `content` management system ce…
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
