FearlessCMS EUVD-2026-98836

Requires an authenticated administrator account with access to admin/updater-handler.php and the ability to invoke the dashboard update feature (perform_update → update.sh); the attacker must supply a Git repository URL, which the updater clones and uses to overwrite plugins/, admin/, and includes/ with no verification of repository identity, signatures, or contents. A key deployment precondition is that the instance serves via the PHP built-in development server, since router.php permits existing PHP files under plugins/ to be executed - this is the documented run mode for the project. Limiting factors: exploitation is gated on high-privilege (administrator) authentication rather than any default/anonymous path, and only affects versions 0.1.2b and earlier (fixed in 0.1.3b), so defenders can treat admin-access control and patching as effective mitigations.

The input provides a CVSS 3.1 vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (base 9.1), which is high largely because of the scope-change (S:C) and triple-high impact; however, the single most important limiting signal is PR:H - exploitation requires a pre-authenticated administrator. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input either. The net picture is a genuinely severe post-authentication RCE/persistence primitive, but NOT an unauthenticated internet-spray risk: an attacker who already holds admin credentials can achieve full code execution, so the real-world priority is bounded by how exposed/privileged-access-controlled the admin panel is. Note a tension worth flagging: the vendor-supplied vector uses S:C, which inflates the score to 9.1, but for an admin-triggered update feature whose code runs as the same web-server process, a scope-unchanged (S:U) reading is also defensible and would lower the base score to ~8.8 - this is an analyst judgment, not a confirmed fact. Absent exploitation telemetry, treat this as a high-severity-but-privilege-gated issue: patch promptly, but it is not evidence of mass exploitation.

An attacker who has obtained (or abuses legitimate) administrator access to a FearlessCMS 0.1.2b-or-earlier instance opens admin/updater-handler.php, points the update URL at a malicious Git repository containing a weaponized PHP file under plugins/, and triggers perform_update. update.sh clones the repo and overwrites the live plugins/, admin/, and includes/ directories with no signature or identity check, and router.php then executes the attacker's PHP as the web-server user, yielding code execution and a persistent backdoor. No public exploit code is identified in the provided data, but the attack is mechanically simple once admin access is held.