CVE Intelligence
Analysis AI-assisted

CVE-2026-55695: FearlessCMS: RCE via Unvalidated Update Repository URL in System Updater

FearlessCMS versions 0.1.2b and earlier let an authenticated administrator point the built-in updater at an arbitrary Git repository, and the updater installs its content without verifying it. According to the description, this can lead to execution of arbitrary PHP with web server privileges and persistence as a backdoor. The issue is fixed in version 0.1.3b.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

FearlessCMS is a flat-file content management system. The GitHub advisory GHSA-56wm-3q3v-m93m describes a flaw in the built-in system updater that lets an authenticated administrator direct the update process to an arbitrary Git repository. The updater replaces live application directories without verifying what it downloads.

Impact

The record rates this issue as critical, with a CVSS 3.1 base score of 9.1 and CWE-94 (Code Injection). According to the description, attacker-supplied update content can execute arbitrary PHP with the web server process privileges and persist as a backdoor. The vector rates confidentiality, integrity and availability impacts as high and indicates a changed scope.

Affected products and versions

  • FearlessCMS (listed in the record as Fearlessgeekmedia Fearlesscms), versions earlier than 0.1.3b.
  • According to the description, versions 0.1.2b and earlier are affected.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The SSVC data in the record carries the exploitation value 'poc', which indicates that a proof of concept may exist; this is not evidence of exploitation in the wild. No EPSS score is available.

Remediation and mitigation

  • Upgrade FearlessCMS to version 0.1.3b or later, as stated in the description.
  • Until the upgrade is applied, limit administrator accounts to trusted users and review who currently holds them.
  • Confirm that the updater is not configured to pull from untrusted sources, and disable it where it is not needed.
  • Review the 0.1.3 release and the referenced commit to confirm the changes applied.

Detection guidance

  • Review administrator activity logs for changes to updater settings or update runs that were not expected.
  • Compare the files under plugins, admin and includes against a trusted copy and investigate any unexpected or modified PHP files.
  • Monitor the web server for requests to PHP files that are not part of the expected installation.

Limitations of the available information

  • The record has an empty fixes field. The fixed version 0.1.3b comes from the description, while the release reference uses the tag 0.1.3. Whether the tag and the fixed version correspond exactly should be confirmed with the vendor.
  • No EPSS score is available.
  • The contents of update.sh and of the referenced commit were not available beyond the reference links, so the exact code paths could not be verified here.

Frequently asked questions

Which FearlessCMS versions are affected by CVE-2026-55695?

According to the record, versions earlier than 0.1.3b are affected, and the description names 0.1.2b and earlier. The fix is in version 0.1.3b.

Does this vulnerability require administrator access?

Yes. The description states that an authenticated administrator can set the update repository URL, and the CVSS vector lists high privileges required.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.