PT-2026-31607 · Thedaylightstudio · Fuel Cms

Published 2026-04-09 · Updated 2026-04-16 · CVE-2026-30461

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Daylight Studio FuelCMS version 1.5.2

Description An authenticated remote code execution issue exists when development mode is enabled, git over SSH is active, and a valid .git directory is present in the root. The lack of enforced access control on the add git submodule() function within the '/controllers/Installer.php' endpoint allows an authenticated user to clone an arbitrary repository, such as a PHP shell, into the modules directory and execute it via the browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-30461

Affected Products

Fuel Cms

References · 8

• 🔥 https://pentest-tools.com/PTT-2025-028-Authenticated-RCE-via-Git-Submodules.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30461 · Security Note
• https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Installer.php · Note
• http://daylight.com · Note
• http://fuelcms.com · Note
• https://twitter.com/CVEnew/status/2044738012731375795 · Twitter Post
• https://i.redd.it/siag5ip685ug1.png · Reddit Post
• https://twitter.com/infoflowcloud/status/2044739646362447928 · Twitter Post