Key points
- CVE-2026-55695 allows remote code execution through the admin update handler.
- The flaw affects FearlessCMS versions prior to 0.1.3b, including 0.1.2b.
- Malicious content replaces core directories without identity or signature verification.
Malicious code injected via the FearlessCMS update mechanism executes arbitrary PHP with web server privileges. This behavior targets administrators who use the built-in updater to modify site plugins or core files. The vulnerability enables attackers to persist as backdoors by replacing live directories with attacker-supplied content.
According to the National Vulnerability Database, CVE-2026-55695 is rated Critical with a CVSS score of 9.1. The flaw exists in FearlessCMS 0.1.2b and earlier releases. An authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php. This action triggers perform_update, which passes the URL to update.sh.
What we know
The update script clones the specified repository and replaces the live plugins, admin, and includes directories. The process does not verify the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to execute, the injected code runs immediately. This results in arbitrary PHP execution with the web server process's privileges. The issue is fixed in version 0.1.3b.
Defender's checklist
- Verify current FearlessCMS version is 0.1.3b or later.
- Audit admin/updater-handler.php for unauthorized modifications.
- Check plugins, admin, and includes directories for unknown files.
- Monitor server logs for unexpected Git clone operations.
What analysts watch for
Teams usually examine file integrity changes in core directories after updates. Analysts check whether the update mechanism validates source repositories or signatures. Persistence often appears as new PHP files in plugin folders. Investigators look for outbound connections to Git servers during maintenance windows. They also review administrative logs for unusual update triggers. This behavior helps identify compromised update pipelines.
What to do and how to stay safe: FearlessCMS
- Update to FearlessCMS 0.1.3b or later immediately.
- Restrict access to admin/updater-handler.php to trusted IPs.
- Monitor for unexpected changes in plugins and includes directories.
- Review server logs for unauthorized Git operations or PHP execution.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of FearlessCMS are affected by CVE-2026-55695?
Versions 0.1.2b and earlier are affected. The issue is fixed in version 0.1.3b.
How does the vulnerability allow remote code execution?
An admin sets an arbitrary Git URL in the updater, which clones and replaces core directories with unverified code.
What privileges does the executed code have?
The code executes with the web server process's privileges, allowing arbitrary PHP execution.
