CVE-2026-30461: 
Fuel CMS vulnerability analysis and mitigation

CVE-2026-30461 is an authenticated remote code execution (RCE) vulnerability in Daylight Studio FuelCMS v1.5.2, discovered in the /fuel/modules/fuel/controllers/Installer.php file within the add_git_submodule function. The vulnerability was published on April 15, 2026, with the GitHub Advisory (GHSA-q6p9-89h2-c9h9) added the same day. Only FuelCMS version 1.5.2 is confirmed affected. It carries a CVSS v3.1 base score of 8.3 (High) (Github Advisory, Feedly).

The root cause is improper neutralization of special elements used in a command (CWE-77 — Command Injection). In the add_git_submodule function of Installer.php, user-supplied URI segments are parsed and directly interpolated into a git submodule add shell command executed via shell_exec() without any sanitization or validation of the repository URL or module path parameters. An authenticated attacker with low privileges can craft a malicious URL path containing shell metacharacters or a malicious repository URL, causing arbitrary OS commands to execute in the context of the web server process. A technical write-up is referenced via a Pentest Tools advisory (Github Advisory, FuelCMS Installer Source).

Successful exploitation allows an authenticated low-privileged attacker to execute arbitrary operating system commands on the server, resulting in high confidentiality and integrity impact — including access to sensitive files, application data, credentials, and the ability to modify or delete content. Availability impact is rated low, meaning partial service disruption is possible. Depending on server configuration, exploitation could enable lateral movement within the hosting environment or full server compromise (Github Advisory, Feedly).

A technical advisory PDF (PTT-2025-028) referencing authenticated RCE via Git Submodules has been identified as a reference, though its content could not be fully verified as a working exploit (Github Advisory). There is no confirmed in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.33–0.38%, placing it around the 60th percentile for exploitation probability within 30 days (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing FuelCMS v1.5.2 installations using search engines (e.g., Shodan, Censys) or by fingerprinting the CMS via its default paths and headers.
2. Authenticate: Obtain valid low-privileged credentials to the FuelCMS admin panel (e.g., via credential stuffing, phishing, or default credentials).
3. Craft malicious request: Construct a URL targeting the add_git_submodule function in Installer.php, embedding shell metacharacters or a malicious repository URL within the URI path segments. For example: /fuel/installer/add_git_submodule/<malicious-repo-url-with-injected-commands>/<module-name>.
4. Trigger command injection: The application parses the URI, substitutes -at- with @, and passes the unsanitized input directly to shell_exec('git submodule add ' . $repo . ' ' . $module_folder). Injected shell metacharacters (e.g., ;, &&, |) cause additional OS commands to execute.
5. Achieve code execution: The injected command runs as the web server user, enabling reverse shell establishment, data exfiltration, or further persistence on the server (FuelCMS Installer Source, Github Advisory).

• Network: Unusual HTTP GET/POST requests to /fuel/installer/add_git_submodule/ with unexpected or encoded path segments; outbound connections from the web server to unknown external hosts (potential reverse shell or data exfiltration).
• Logs: Web server access logs showing requests to /fuel/modules/fuel/controllers/Installer.php or the add_git_submodule route with suspicious URI parameters containing shell metacharacters (;, &&, |, backticks); PHP error logs showing unexpected shell_exec output.
• File System: New or modified files in the FuelCMS modules directory; unexpected .git directories or submodule configurations created in web-accessible paths; web shells dropped in the application directory.
• Process: Unexpected child processes spawned by the PHP/web server process (e.g., bash, sh, curl, wget, nc, python) visible in process listings (FuelCMS Installer Source, Github Advisory).

Upgrade FuelCMS beyond version 1.5.2 to a patched release once available, as referenced in the GitHub Advisory (GHSA-q6p9-89h2-c9h9). As an immediate workaround, restrict access to the /fuel/installer/ route and the Installer.php controller to trusted administrator IP addresses only via web server configuration (e.g., .htaccess or nginx allow/deny directives). Additionally, disable or remove the installer functionality entirely if it is not required in production environments, and audit all authenticated user accounts to minimize exposure (Github Advisory, Feedly).

The vulnerability was noted by automated CVE tracking services and security aggregators shortly after publication on April 15, 2026, including VulDB, CVEFeed, and INCIBE-CERT. No significant vendor statements, notable researcher commentary, or major media coverage has been identified beyond standard CVE aggregation (Feedly).