---
id: "CVE-2026-63190"
kind: "vulnerability"
aliases: ["CVE-2026-63190"]
title: "FearlessCMS: unauthenticated admin scripts allow file writes and site defacement"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["docker", "fearlesscms", "other", "php", "self-hosted"]
not_affected_if: ["not-on-php-built-in-server", "version-0.1.4-or-later"]
published_at: "2026-10-28T20:18:37+00:00"
first_seen_at: "2026-10-28T20:35:10+00:00"
updated_at: "2026-10-28T20:36:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63190", "first_seen_at": "2026-10-28T20:35:10+00:00"}]
---

# FearlessCMS: unauthenticated admin scripts allow file writes and site defacement

FearlessCMS before 0.1.4 ships debug and test PHP scripts under admin/ that skip login and CSRF checks and accept unvalidated paths and content. An attacker can read and write .md files on the server, including outside the content directory, and inject stored JavaScript that can steal administrator sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version is below `0.1.4`; the sources do not say how to read it.
- Look for the debug and test scripts: `ls admin/debug_save_flow.php admin/debug_content.php admin/preview-handler.php admin/testdebug.php admin/test_redirect.php`
- Check whether the site runs on PHP's built-in development server (`php -S`) or the default Docker image, since the login bypass is stated for those.

## Fix

- Upgrade FearlessCMS to `0.1.4` or later.
- Until upgraded, do not expose the admin directory or run the site on PHP's built-in server.
- unknown for any other mitigation; the sources do not give one.

## Timeline

- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63190

## From the sources

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_