Skip to content
Critical Path Traversal Vulnerability in FearlessCMS Disclosed

Critical Path Traversal Vulnerability in FearlessCMS Disclosed

First seen 29 Oct 2026, 01:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 02:12 UTC
  • •CVE-2026-63190 allows unauthenticated access to admin scripts in FearlessCMS.
  • •The vulnerability can lead to arbitrary file writes and stored XSS attacks.
  • •Users must upgrade to version 0.1.4 or later to mitigate this critical risk.

A critical vulnerability, CVE-2026-63190, has been identified in FearlessCMS, a flat-file content management system, allowing unauthenticated attackers to execute privileged PHP scripts in the `/admin/` directory. This flaw arises from improper authentication and path validation, enabling attackers to perform path traversal attacks, write arbitrary files, and execute stored JavaScript, leading to potential site defacement and data exposure. The vulnerability affects versions prior to 0.1.4 and has a CVSS score of 9.4, indicating a critical severity level. As of now, there is no evidence of or public proof-of-concept code. Users are advised to upgrade to version 0.1.4 or later and implement security measures to mitigate risks. The vulnerability was published on October 28, 2026, and is currently.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
CVE-2026-63190 published
The vulnerability in FearlessCMS was disclosed, highlighting critical flaws in the admin scripts.
Feedly
2026-10-28
Vulnerability details released
Multiple outlets reported on the critical vulnerabilities in FearlessCMS, emphasizing the lack of authentication and CSRF protection.
Sploitus
2026-10-29
Vulnerability awareness raised
SecurityVulnerability.io published details on the critical flaws in FearlessCMS, urging immediate updates.
securityvulnerability.io

More articles in this cluster (4)

Following this threat?

Track CVE-2026-117574 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

What versions of FearlessCMS are affected?
Versions prior to 0.1.4 are affected by CVE-2026-63190.
Is there a patch available?
Yes, users should upgrade to version 0.1.4 or later to address the vulnerabilities.
What are the potential impacts of this vulnerability?
Attackers could exploit this flaw to deface websites, inject malicious scripts, and access sensitive information.