FearlessCMS: Unauthenticated debug script RCE and information disclosure (CVE-2026-63190)

FearlessCMS versions prior to 0.1.4 contain five unauthenticated debug scripts within the 'admin/' directory. An authentication bypass exists due to inconsistent handling of unnormalized URI prefixes (e.g., using '/./admin/'), which allows attackers to reach these scripts despite authentication gates. These endpoints enable arbitrary filesystem reads and writes, stored XSS, and disk exhaustion. The vulnerability is fixed in version 0.1.4.

Attack Chain

1. Attacker crafts an HTTP request using an unnormalized path (e.g., '/./admin/debug_save_flow.php') to bypass authentication checks in 'router.php'.
2. The application serves the requested debug script with administrative privileges.
3. Attacker uses 'admin/debug_save_flow.php' to perform path traversal and arbitrary file writes ('file_put_contents') to inject malicious content or stored XSS payloads.
4. Attacker uses 'admin/debug_content.php' to enumerate directories and read sensitive files via 'scandir' and 'file_get_contents'.
5. Attacker utilizes 'admin/preview-handler.php' or 'admin/testdebug.php' to induce disk exhaustion by writing excessive data to the server.
6. Stored XSS payloads execute in the context of administrators who view the manipulated content, potentially leading to session hijacking.

Impact

Successful exploitation allows site defacement, unauthorized access to sensitive application data, potential session compromise via XSS, and service disruption through disk exhaustion. In default deployments where the application runs as root, these operations may result in full system compromise.

Recommendation

• Upgrade FearlessCMS to version 0.1.4 or later immediately.
• Audit logs for requests containing suspicious directory traversal sequences such as '/./admin/' or '..' in URI stems.
• Review all contents of the 'content/' directory for unauthorized modifications or embedded JavaScript.