CVE-2026-63190: FearlessCMS is a flat-file `content` management system ce… TheHackerWire / 4h nFearlessCMS versions prior to 0.1.4 are critically vulnerable to an unauthenticated admin URI bypass, exposing five debug scripts that permit arbitrary file writes, sensitive data enumeration, stored cross-site scripting, and denial-of-service. Telemetry Metric Intelligence Detail CVE Identifier CVE-2026-63190 CVSS Severity 9.4 CRITICAL Affected Target login gate Vulnerability Class CWE-79: Cross-Site

No standalone public exploit has been published in open research repositories at the time of writing. Our threat intelligence pipeline monitors GitHub, Exploit-DB, and Nuclei feeds continuously. Verified PoCs will be automatically integrated here upon discovery.

{ “title”: “FearlessCMS Unauthenticated Admin Bypass Leads to Arbitrary File Write, Data Exposure, and System Compromise”, “content”: “

nFearlessCMS versions prior to 0.1.4 are critically vulnerable to an unauthenticated admin URI bypass, exposing five debug scripts that permit arbitrary file writes, sensitive data enumeration, stored cross-site scripting, and denial-of-service. Exploitation leverages PHP’s built-in development server and default Docker configurations, enabling full system compromise due to execution with root privileges.n

Vulnerability Root Cause & Flaw Mechanism

nThis critical vulnerability, identified as CVE-2026-63190, stems from a fundamental design flaw in FearlessCMS’s `router.php` combined with a lack of robust authentication and input validation in several administrative debug scripts. The primary bypass mechanism involves `router.php` checking an unnormalized admin URI prefix while the underlying filesystem resolves dot segments. Consequently, an unauthenticated request to `/./admin/` bypasses the `isLoggedIn()` authentication gate, directly exposing five privileged debug/test PHP scripts under the `admin/` directory.nnSpecifically, `admin/debug_save_flow.php` is vulnerable to arbitrary file writes. Attacker-controlled `path` and `content` parameters are passed directly to `file_put_contents`, allowing the creation or modification of arbitrary `.md` files within or outside the `content/` directory via path traversal. This enables site defacement, injection of stored JavaScript into public pages, and potential remote code execution. Furthermore, `print_r($_POST)` output without `htmlspecialchars` escaping in this script facilitates reflected cross-site scripting. The `admin/debug_content.php` script exposes sensitive system information; its `path` parameter reaches `scandir()`, `file_get_contents()`, and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that reveal absolute paths, ownership, permissions, file hashes, and content previews. `admin/preview-handler.php` accepts JSON `content` and `title`, writing enumerable files under `content/_preview/`, leading to stored cross-site scripting and potential disk exhaustion. Finally, `admin/testdebug.php` appends data to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script is an exposed artifact but is not an XSS sink itself. All read and write operations execute with PHP’s privileges, which, in the tested deployment, run as root, significantly amplifying the filesystem impact to full system compromise.nn

Attack Prerequisites & Threat Vector

nExploitation of CVE-2026-63190 is pre-authentication and requires no prior knowledge of the target system beyond identifying a vulnerable FearlessCMS instance. The attack vector is remote, accessible over WAN, targeting instances running PHP’s built-in development server, including the default Docker deployment. No specific survey hashes, API tokens, or nonces are required. The attack progression initiates with an unauthenticated HTTP request leveraging the URI normalization bypass, specifically targeting `/./admin/` to gain access to the debug scripts. Subsequent requests are then directed to specific vulnerable endpoints, such as `/./admin/debug_save_flow.php` or `/./admin/debug_content.php`, with crafted `path` and `content` parameters. For arbitrary file writes, an attacker would supply a path traversal sequence (e.g., `path=../../../../tmp/shell.php`) and malicious `content`. For information disclosure, a `path` parameter pointing to sensitive directories or files would be used (e.g., `path=../../../../etc/passwd`). Stored XSS attacks involve injecting JavaScript into `content` parameters for `debug_save_flow.php` or `preview-handler.php` that will be rendered by an unsuspecting administrator or user.nn

Detection, Log Analysis & Threat Hunting

nSOC analysts and threat hunters should prioritize monitoring web server access logs for anomalous URI patterns indicative of the admin bypass. Specifically, look for requests containing `/./admin/` in the URI path. Further indicators include requests to `debug_save_flow.php`, `debug_content.php`, `preview-handler.php`, or `testdebug.php` without preceding successful authentication events. Parameter anomalies within these requests, such as `path` values containing directory traversal sequences (`../`, `../../`) or absolute paths (`/etc/passwd`), or unusually large `content` payloads, are critical red flags. Monitoring for unexpected file system modifications, particularly new or altered `.md` files outside the expected `content/` structure, or rapid growth in `admin/testdebug.log` and files within `content/_preview/`, is essential. For asset owners, a practical Shodan or Google Recon query to identify potentially exposed instances is `http.title:”FearlessCMS”` or `http.html:”FearlessCMS”`, focusing on deployments running PHP’s development server or default Docker configurations.nn

Defensive Hardening & Mitigation

nImmediate mitigation for systems awaiting the vendor patch involves implementing network access controls to restrict direct external access to the `admin/` directory. Web Application Firewall (WAF) rules should be deployed to block requests containing `/./admin/` in the URI path and to filter `path` parameters for directory traversal sequences (`../`) or absolute file paths directed at the identified vulnerable scripts. Consider isolating the FearlessCMS application into a segmented VLAN, limiting its network exposure. Implement file integrity monitoring (FIM) on the `content/` and `admin/` directories to detect unauthorized file creations or modifications. Ensure PHP is not running with root privileges; adopt the principle of least privilege for all application services. The definitive fix for CVE-2026-63190 is to upgrade FearlessCMS to version 0.1.4 or later, which addresses the URI bypass and secures the vulnerable debug scripts.” }

Related Vulnerabilities

CVE-2026-111411: FunnelKit Automations Blind SQLi: Critical Data Exfiltration Vector

CVE-2026-44179: XWiki Remote Macros Syntax Injection Leads to Remote Code Execution (CVE-2026-44179)

CVE-2026-118477: KaliFast OS Command Injection Allows Authenticated Server Takeover

TheHackerWire Threat Intel Team