{"id":"CVE-2026-63190","revision":"af889769cfe94259875ec9ac94d62256","records":[{"revision":"af889769cfe94259875ec9ac94d62256","observedAt":"2026-10-28T20:55:13.289+00:00","statement":{"source":"cve-program","id":"CVE-2026-63190","aliases":[],"title":"FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS","description":"FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.","state":0,"publishedAt":"2026-10-28T19:28:00.08+00:00","modifiedAt":"2026-10-28T19:28:00.08+00:00","affected":[{"ecosystem":"Vendor product","name":"FearlessCMS","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"fearlessgeekmedia\",\n                    \"product\": \"FearlessCMS\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.1.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","score":9.4,"severity":"CRITICAL"}],"references":["https://github.com/fearlessgeekmedia/FearlessCMS/security/advisories/GHSA-3mq8-hrhf-7hv6","https://github.com/fearlessgeekmedia/FearlessCMS/commit/59fb22cf989b5ba14c387c3212e15b146e02cf9a","https://github.com/fearlessgeekmedia/FearlessCMS/tree/0.1.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63190","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63190","identifiers":["CVE-2026-63190"]},"retained":false,"historicalAffected":[]}],"coverage":[]}