What is the CVSS score of EUVD-2026-25881?

EUVD-2026-25881 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

FuelCMS EUVD-2026-25881

| CVE-2026-30462 MEDIUM

Path Traversal (CWE-22)

2026-04-27 cve@mitre.org

Path Traversal

4.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible CMS endpoint (AV:N), requires authenticated low-privileged account (PR:L), read-only partial file disclosure (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:59 vuln.today

CVSS changed

Apr 27, 2026 - 18:22 NVD

4.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 17:22 euvd

EUVD-2026-25881

CVE Published

Apr 27, 2026 - 17:16 nvd

MEDIUM 4.3

DescriptionCVE.org

A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.

AnalysisAI

Path traversal in the Blocks module of Daylight Studio FuelCMS v1.5.2 enables authenticated low-privileged users to read arbitrary server-side files outside the web root by injecting directory traversal sequences into the module's path parameter. A public proof-of-concept is confirmed via SSVC exploitation status and the pentest-tools advisory (PTT-2025-031), though no active exploitation appears in CISA KEV. With an EPSS of 0.06% (19th percentile) and a read-only, non-automatable attack profile, this represents a real but low-urgency confidentiality risk - file disclosure rather than code execution.

Technical ContextAI

FuelCMS is a CodeIgniter-based PHP content management system developed by Daylight Studio. The vulnerability resides in the Blocks module controller at fuel/modules/fuel/controllers/Blocks.php, which handles management of reusable content blocks. CWE-22 (Path Traversal) identifies the root cause as insufficient sanitization of user-supplied filesystem path input - the controller fails to canonicalize or restrict path segments, allowing an attacker to supply sequences such as '../' or URL-encoded variants to escape the intended directory and reach files elsewhere on the server. No CPE string was provided in the input, but the affected product and version (v1.5.2) are derived from the CVE description and EUVD-2026-25881. The web server process user's read permissions define the outer boundary of what files can be accessed.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified at time of analysis - EUVD lists version data as 'n/a n/a' and no tagged patched release appears in the referenced data. The GitHub reference to Blocks.php (https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Blocks.php) may reflect repository-level changes, but a released patched version is not independently confirmed. Full vulnerability details are documented in the pentest-tools advisory at https://pentest-tools.com/PTT-2025-031-Sensitive-File-Read-via-Path-Traversal.pdf. Until a patch is available, administrators should restrict CMS user roles from accessing the Blocks module endpoint unless strictly necessary - note this may impact legitimate content management workflows. Deploy a web application firewall rule to detect and block path traversal patterns (../, %2e%2e/, encoded variants) on the /fuel/blocks/ route. Additionally, minimize the web server process user's filesystem read permissions to reduce the accessible file surface, particularly excluding application configuration files, .env files, and credential stores.