EUVD-2026-25881Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible CMS endpoint (AV:N), requires authenticated low-privileged account (PR:L), read-only partial file disclosure (C:L), no integrity or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.
AnalysisAI
Path traversal in the Blocks module of Daylight Studio FuelCMS v1.5.2 enables authenticated low-privileged users to read arbitrary server-side files outside the web root by injecting directory traversal sequences into the module's path parameter. A public proof-of-concept is confirmed via SSVC exploitation status and the pentest-tools advisory (PTT-2025-031), though no active exploitation appears in CISA KEV. With an EPSS of 0.06% (19th percentile) and a read-only, non-automatable attack profile, this represents a real but low-urgency confidentiality risk - file disclosure rather than code execution.
Technical ContextAI
FuelCMS is a CodeIgniter-based PHP content management system developed by Daylight Studio. The vulnerability resides in the Blocks module controller at fuel/modules/fuel/controllers/Blocks.php, which handles management of reusable content blocks. CWE-22 (Path Traversal) identifies the root cause as insufficient sanitization of user-supplied filesystem path input - the controller fails to canonicalize or restrict path segments, allowing an attacker to supply sequences such as '../' or URL-encoded variants to escape the intended directory and reach files elsewhere on the server. No CPE string was provided in the input, but the affected product and version (v1.5.2) are derived from the CVE description and EUVD-2026-25881. The web server process user's read permissions define the outer boundary of what files can be accessed.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified at time of analysis - EUVD lists version data as 'n/a n/a' and no tagged patched release appears in the referenced data. The GitHub reference to Blocks.php (https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Blocks.php) may reflect repository-level changes, but a released patched version is not independently confirmed. Full vulnerability details are documented in the pentest-tools advisory at https://pentest-tools.com/PTT-2025-031-Sensitive-File-Read-via-Path-Traversal.pdf. Until a patch is available, administrators should restrict CMS user roles from accessing the Blocks module endpoint unless strictly necessary - note this may impact legitimate content management workflows. Deploy a web application firewall rule to detect and block path traversal patterns (../, %2e%2e/, encoded variants) on the /fuel/blocks/ route. Additionally, minimize the web server process user's filesystem read permissions to reduce the accessible file surface, particularly excluding application configuration files, .env files, and credential stores.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today