{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fearlesscms--0.1.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fearlessgeekmedia:fearlesscms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.4,"id":"CVE-2026-63190"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FearlessCMS (\u003c 0.1.4)"],"_cs_severities":["critical"],"_cs_tags":["web-application","cms","remote-code-execution","cve"],"_cs_type":"advisory","_cs_vendors":["FearlessCMS"],"content_html":"\u003cp\u003eFearlessCMS versions prior to 0.1.4 contain five unauthenticated debug scripts within the 'admin/' directory. An authentication bypass exists due to inconsistent handling of unnormalized URI prefixes (e.g., using '/./admin/'), which allows attackers to reach these scripts despite authentication gates. These endpoints enable arbitrary filesystem reads and writes, stored XSS, and disk exhaustion. The vulnerability is fixed in version 0.1.4.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts an HTTP request using an unnormalized path (e.g., '/./admin/debug_save_flow.php') to bypass authentication checks in 'router.php'.\u003c/li\u003e\n\u003cli\u003eThe application serves the requested debug script with administrative privileges.\u003c/li\u003e\n\u003cli\u003eAttacker uses 'admin/debug_save_flow.php' to perform path traversal and arbitrary file writes ('file_put_contents') to inject malicious content or stored XSS payloads.\u003c/li\u003e\n\u003cli\u003eAttacker uses 'admin/debug_content.php' to enumerate directories and read sensitive files via 'scandir' and 'file_get_contents'.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes 'admin/preview-handler.php' or 'admin/testdebug.php' to induce disk exhaustion by writing excessive data to the server.\u003c/li\u003e\n\u003cli\u003eStored XSS payloads execute in the context of administrators who view the manipulated content, potentially leading to session hijacking.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows site defacement, unauthorized access to sensitive application data, potential session compromise via XSS, and service disruption through disk exhaustion. In default deployments where the application runs as root, these operations may result in full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade FearlessCMS to version 0.1.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for requests containing suspicious directory traversal sequences such as '/./admin/' or '..' in URI stems.\u003c/li\u003e\n\u003cli\u003eReview all contents of the 'content/' directory for unauthorized modifications or embedded JavaScript.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T23:36:52Z","date_published":"2026-10-28T23:36:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fearlesscms-unauth-debug/","summary":"CVE-2026-63190 allows unauthenticated attackers to bypass authentication via path normalization discrepancies to execute arbitrary filesystem operations, read sensitive files, and perform stored XSS in FearlessCMS versions prior to 0.1.4.","title":"FearlessCMS: Unauthenticated debug script RCE and information disclosure (CVE-2026-63190)","url":"https://feed.craftedsignal.io/briefs/2026-10-fearlesscms-unauth-debug/"}],"language":"en","title":"CraftedSignal Threat Feed - FearlessCMS (\u003c 0.1.4)","version":"https://jsonfeed.org/version/1.1"}