What is the CVSS score of EUVD-2026-16301?

EUVD-2026-16301 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16301?

Organizations using the /parser/dwoo component of Daylight Studio FuelCMS face critical risk from CVE-2026-30457, a code injection vulnerability rated CVSS 9.8.

How to fix or mitigate EUVD-2026-16301?

Within 24 hours: Identify all affected systems running the /parser/dwoo component of Daylight Studio FuelCMS and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

PHP EUVD-2026-16301

| CVE-2026-30457 CRITICAL

Code Injection (CWE-94)

2026-03-26 mitre

PHP RCE Code Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 19:00 euvd

EUVD-2026-16301

Analysis Generated

Mar 26, 2026 - 19:00 vuln.today

CVE Published

Mar 26, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

AnalysisAI

Remote code execution in Daylight Studio FuelCMS v1.5.2 through the /parser/dwoo component enables unauthenticated attackers to execute arbitrary PHP code via specially crafted input. The vulnerability exploits insufficient input validation in the Dwoo template engine integration, allowing direct PHP code injection. Attack complexity appears low given the public references to exploitation techniques in the provided pentest-tools PDF, though no formal CVSS scoring or CISA KEV confirmation is available to assess real-world exploitation prevalence.

Technical ContextAI

FuelCMS v1.5.2 integrates the Dwoo template engine as a parser component (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* indicates incomplete CPE data in available sources). The vulnerability likely stems from improper sanitization or escaping of user-supplied template code before processing by Dwoo, creating a code injection vector. Dwoo processes PHP-like syntax and can execute embedded PHP under certain configurations; without proper input filtering, attackers can leverage this to break out of template sandboxing and execute arbitrary system commands. The root cause aligns with improper input validation and inadequate output encoding practices common in template engine vulnerabilities (related to CWE-94: Improper Control of Generation of Code). The GitHub reference to the fuel/modules/fuel/libraries/parser/dwoo directory confirms the vulnerable component location.

RemediationAI

Upgrade Daylight Studio FuelCMS to a patched version released after v1.5.2; exact fix version is not specified in available data, so consult the vendor advisory at http://fuelcms.com and the GitHub repository (https://github.com/daylightstudio/FUEL-CMS) for the latest stable release. Until patching is possible, implement input validation and output encoding on all user-supplied template code before it reaches the Dwoo parser; consider disabling the /parser/dwoo endpoint if not in active use, and restrict network access to the FuelCMS administrative interface to trusted IP ranges. Apply a Web Application Firewall (WAF) rule to block requests containing suspicious PHP code patterns (e.g., 'php', 'eval', 'system', 'passthru') in template parameters as a temporary compensating control.