CVE-2026-55695

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...

CVE-2026-55695

FearlessCMS versions 0.1.2b and earlier are vulnerable to Remote Code Execution via an unvalidated Git repository URL in the system updater. An authenticated administrator can provide an arbitrary URL through admin/updater-handler.php, which is then passed to update.sh. The updater clones this re...

CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...

CVE-2026-55695: Improper Control of Generation of Code

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger performupdate, which passes the URL to update.sh. The updater...