{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "cve-2026-63190",
    "url": "https://cveboard.org/i/cve-2026-63190",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-63190",
    "json": "https://cveboard.org/i/cve-2026-63190.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "fearlessgeekmedia FearlessCMS",
    "summary": "FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation.",
    "titlePt": "fearlessgeekmedia FearlessCMS",
    "summaryPt": "FearlessCMS é um sistema de gerenciamento de conteúdo `flat-file` centrado na simplicidade e no código aberto. Antes da versão 0.1.4, cinco scripts PHP de depuração/teste sob `admin/` realizam operações privilegiadas sem verificações de autenticação `isLoggedIn()`, proteção contra CSRF ou validação adequada de `path`.",
    "affected": [
      {
        "vendor": "fearlessgeekmedia",
        "product": "FearlessCMS",
        "defaultStatus": "unknown",
        "versions": [
          {
            "version": "< 0.1.4",
            "status": "affected",
            "lessThan": null,
            "lessThanOrEqual": null
          }
        ],
        "omitted": 0,
        "fixed": []
      }
    ],
    "omitted": 0,
    "references": [],
    "cwes": [
      {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      },
      {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
      },
      {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      }
    ],
    "ssvc": null,
    "fix": "none",
    "tags": [
      "fearlessgeekmedia"
    ],
    "description": "FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.",
    "descriptionFrom": "cve",
    "descriptionAt": null,
    "summaryFrom": "cve",
    "cves": [
      "CVE-2026-63190"
    ],
    "ghsa": null,
    "cvss": {
      "score": 9.4,
      "version": "3.1",
      "by": "GitHub_M"
    },
    "epss": null,
    "packages": [],
    "vendor": "fearlessgeekmedia",
    "product": "FearlessCMS",
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "cve.now",
        "url": "https://cve.now/CVE-2026-63190"
      }
    ],
    "cveVersion": 1,
    "cvePending": false,
    "publishedAt": "2026-10-28T19:28:00.080Z",
    "updatedAt": "2026-10-28T19:28:00.080Z"
  },
  "live": true,
  "events": [
    {
      "id": "cvenow:CVE-2026-63190:cvenow_discovered:first",
      "incidentId": "cve-2026-63190",
      "type": "cvenow_discovered",
      "at": "2026-10-28T19:28:00.080Z",
      "detail": {}
    }
  ]
}