CVE-2026-55695

Summary

An authenticated administrator can trigger arbitrary code execution by uploading malicious Git repositories that get executed as PHP files through the web server, allowing attackers to establish persistent backdoors with web server privileges.

Exploitability

Exploitation requires an authenticated admin account and is relatively straightforward once access is gained, as it involves setting a Git repository URL and triggering an update process.

Blast radius

The impact could be severe across all affected FearlessCMS installations, potentially allowing attackers to gain full control of web applications and persistently maintain access through backdoor PHP files.

Detection

Monitor for unusual Git repository URL settings in admin/updater-handler.php and check for newly created or modified PHP files in plugins/, admin/, and includes/ directories that could indicate backdoor persistence.

Prioritized remediation

Upgrade to version 0.1.3b immediately to address this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.