CVE-2026-55695
Received Received - Intake

Authenticated Remote Code Execution in FearlessCMS via Arbitrary Git Repository Update

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-55695
EUVD
EUVD-2026-98836

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fearlessgeekmedia FearlessCMS < 0.1.3b

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55695 is a critical remote code execution (RCE) vulnerability in FearlessCMS versions 0.1.2b and earlier. An authenticated administrator can set a malicious Git repository URL in the updater settings. When the update is triggered, the system clones the repository and replaces core directories like plugins/, admin/, and includes/ without validating the repository's identity or contents. This allows an attacker to deploy arbitrary PHP code that executes with the web server's privileges, creating a persistent backdoor.

Detection Guidance

Check for unauthorized Git repository URLs configured in admin/updater-handler.php. Inspect update.sh for suspicious repository cloning commands. Look for unexpected modifications in plugins/, admin/, or includes/ directories. Monitor network traffic for outbound Git clone operations from the CMS server.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary PHP code on your server with the web server's privileges. This can lead to full system compromise, including reading sensitive files, accessing database credentials, modifying application data, or using the server as a pivot point to attack other systems. The attack requires administrative access but can result in persistent backdoor access even after patching.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized code execution and potential data breaches. GDPR requires protecting personal data with appropriate security measures, while HIPAA mandates safeguards against unauthorized access to protected health information. Exploitation could lead to unauthorized data access, modification, or exfiltration, resulting in regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade FearlessCMS to version 0.1.3b or later immediately. Remove administrative access for any untrusted users. Review update.sh and admin/updater-handler.php for unauthorized changes. Implement network monitoring to block unauthorized Git clone operations from the CMS server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart