FearlessCMS EUVD-2026-112405

Exploitation requires the target to run FearlessCMS ≤ 0.1.2b on PHP's built-in development server - the project's default Docker deployment - because the anonymous entry point is router.php checking an unnormalized admin URI prefix while the filesystem resolves dot segments, so the /./admin/ prefix (sent with curl --path-as-is) bypasses the login gate and executes the unauthenticated debug scripts (debug_save_flow.php, debug_content.php, preview-handler.php, testdebug.php) directly. No credentials, CSRF token, or user interaction are needed for the attacker's own requests (PR:N/UI:N), though the stored-XSS-to-admin-takeover chain does require an administrator to subsequently view the poisoned page. The principal limiting factor is the server mode: production stacks that normalize /./ or route PHP through Apache/nginx+FPM may not expose the router bypass, reducing reachability; filesystem impact is amplified where the PHP process runs as root (as on the tested image).

All decision signals point to genuine high priority, not an inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L = 9.4) describes remote, low-complexity, unauthenticated exploitation, and the vuln.today Decision label is act_now. The GHSA advisory (GHSA-3mq8-hrhf-7hv6) publishes detailed, concrete proof-of-concept exploit commands (nine curl one-liners) that demonstrate each primitive, so trivially reproducible attacks are documented publicly. The one material caveat is deployment dependency: the anonymous reachability of the debug scripts relies on PHP's built-in development server plus the router.php path-normalization bypass (the /./admin/ prefix), which is the project's default Docker configuration but is not how a hardened production stack (Apache mod_php or nginx+PHP-FPM) typically routes requests - on such stacks the /./ normalization behaves differently and the bypass may not apply, though the debug scripts themselves still lack any isLoggedIn() check. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quoted. This CVE is NOT in CISA KEV based on the available data, so there is no confirmed active exploitation despite the published PoC - PoC availability and active exploitation are distinct, and nothing here establishes in-the-wild use. Net: a real, act-now priority driven by unauthenticated RCE-adjacent file-write and disclosure with public PoC, tempered only by the fact that full impact is confirmed on the default dev/Docker deployment and should be verified for other server configurations.

A remote, unauthenticated attacker sends a single crafted POST to /./admin/debug_save_flow.php (using curl --path-as-is to preserve the /./ router bypass) with action=save_content and a content of <script>…</script>, writing a stored-XSS payload into a public page such as home.md. When an administrator next views the site, the script runs in their browser and exfiltrates their session, yielding full admin compromise; the same endpoint also permits ../ path-traversal writes anywhere the PHP process (root on the tested Docker image) can create .md files. Working PoC commands for this and the directory-read primitive (debug_content.php) are published in the GHSA advisory.