Attack Chain

1. Attacker crafts an HTTP request using an unnormalized path (e.g., '/./admin/debug_save_flow.php') to bypass authentication checks in 'router.php'.
2. The application serves the requested debug script with administrative privileges.
3. Attacker uses 'admin/debug_save_flow.php' to perform path traversal and arbitrary file writes ('file_put_contents') to inject malicious content or stored XSS payloads.
4. Attacker uses 'admin/debug_content.php' to enumerate directories and read sensitive files via 'scandir' and 'file_get_contents'.
5. Attacker utilizes 'admin/preview-handler.php' or 'admin/testdebug.php' to induce disk exhaustion by writing excessive data to the server.
6. Stored XSS payloads execute in the context of administrators who view the manipulated content, potentially leading to session hijacking.

Impact

Successful exploitation allows site defacement, unauthorized access to sensitive application data, potential session compromise via XSS, and service disruption through disk exhaustion. In default deployments where the application runs as root, these operations may result in full system compromise.

Recommendation

• Upgrade FearlessCMS to version 0.1.4 or later immediately.
• Audit logs for requests containing suspicious directory traversal sequences such as '/./admin/' or '..' in URI stems.
• Review all contents of the 'content/' directory for unauthorized modifications or embedded JavaScript.