Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63190— FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

Quick assessment

Affected
fearlessgeekmedia FearlessCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FearlessCMS 是一个以简洁性和开源为核心的扁平文件内容管理系统。在 0.1.4 版本之前，位于 目录下的五个调试/测试 PHP 脚本在执行特权操作时，未进行 身份验证检查，也缺乏 CSRF 防护以及充分的路径验证。在 PHP 内置开发服务器（包括默认的 Docker 部署）中， 检查的是未经归一化的管理 URI 前缀，而文件系统会解析点号段（如 或 ），因此攻击者可通过 绕过管理员登录验证，直接执行这些脚本。 具体漏洞影响如下： 在 中，攻击者可控制的 和 参数会被直接传入 函数，导致可在 目录下或通过路

CVSS 9.4 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
fearlessgeekmedia FearlessCMS < 0.1.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63190

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
Source: CVE Program / CVE List V5
Vulnerability Description
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fearlessgeekmedia FearlessCMS < 0.1.4 -

II. Public POCs for CVE-2026-63190

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63190

请登录查看更多情报信息。

Other References for CVE-2026-63190 (3)

IV. Related Vulnerabilities

Same product: FearlessCMS
Same vendor: fearlessgeekmedia
Same weakness: CWE-306