CVE-2026-30461: Fuel CMS Authenticated RCE Vulnerability

CVE-2026-30461 Overview

CVE-2026-30461 is an authenticated remote code execution (RCE) vulnerability in Daylight Studio FuelCMS v1.5.2. The flaw resides in /controllers/Installer.php within the add_git_submodule function. Authenticated attackers can inject arbitrary operating system commands through this function, achieving code execution on the underlying web server. The weakness is classified as Improper Neutralization of Special Elements used in a Command [CWE-77].

Critical Impact

Authenticated attackers can execute arbitrary commands on the FuelCMS host, leading to full compromise of the application and its data.

Affected Products

• Daylight Studio FuelCMS 1.5.2
• Deployments using the FuelCMS Installer module
• Web servers hosting vulnerable FuelCMS instances

Discovery Timeline

• 2026-04-15 - CVE-2026-30461 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-30461

Vulnerability Analysis

The vulnerability exists in the add_git_submodule function inside /controllers/Installer.php. The Installer module accepts user-controlled input and passes it into a Git submodule operation without sufficient neutralization of shell metacharacters. Because the resulting string is executed by the underlying shell, an attacker can append additional commands using standard shell separators.

Exploitation requires valid authentication to FuelCMS, which raises the bar but does not prevent abuse by attackers with low-privilege accounts, stolen credentials, or access through other application flaws. Once command execution is achieved, the attacker runs code with the privileges of the web server process. This typically enables web shell deployment, data exfiltration, lateral movement, and persistence.

The issue is tracked under [CWE-77] Improper Neutralization of Special Elements used in a Command. Technical specifics of the affected code path are documented in the GitHub FUEL-CMS Installer Code and in the Pentest Tools Authenticated RCE Report.

Root Cause

The root cause is missing input validation and unsafe construction of a Git command string from attacker-controlled parameters. The add_git_submodule function concatenates user input into a shell-executed command without escaping or allow-listing safe values.

Attack Vector

The attack is delivered over the network against the FuelCMS administrative interface. An authenticated user submits crafted parameters to the Installer endpoint. The injected metacharacters extend the intended git submodule add invocation with attacker-chosen commands that the operating system executes.

No verified public exploit code is available. Refer to the Pentest Tools Authenticated RCE Report for documented exploitation details.

Detection Methods for CVE-2026-30461

Indicators of Compromise

• Unexpected child processes spawned by the PHP-FPM or web server worker (for example sh, bash, git, curl, wget, python).
• HTTP POST requests to FuelCMS Installer endpoints invoking add_git_submodule with shell metacharacters such as ;, |, &&, or backticks in parameter values.
• New or modified files under the FuelCMS web root, particularly PHP files placed outside expected module directories.
• Outbound network connections from the web server to unfamiliar hosts shortly after Installer requests.

Detection Strategies

• Inspect web access logs for requests targeting /installer routes and flag parameters containing shell separators or URL-encoded equivalents.
• Correlate web request telemetry with process creation events to identify command execution chains originating from the FuelCMS process.
• Monitor for git invocations on production web servers, which are typically uncommon outside deployment windows.

Monitoring Recommendations

• Enable verbose application logging on FuelCMS administrative endpoints and forward logs to a centralized analytics platform.
• Track authentication events on the FuelCMS admin interface to identify credential abuse preceding Installer activity.
• Alert on file integrity changes in the FuelCMS application directory and the server's web root.

How to Mitigate CVE-2026-30461

Immediate Actions Required

• Restrict network access to the FuelCMS administrative interface using firewall rules, VPN, or IP allow-lists.
• Disable or remove the Installer module on production deployments where it is not required.
• Rotate credentials for all FuelCMS administrative accounts and enforce strong, unique passwords.
• Audit application and system logs for prior exploitation indicators before applying remediation.

Patch Information

No vendor patch advisory is referenced in the NVD entry at the time of publication. Monitor the FuelCMS Official Site and the GitHub FUEL-CMS Installer Code repository for updated releases addressing the add_git_submodule command injection. Until a fix is available, apply the compensating controls below.

Workarounds

• Block external access to the /installer route at the reverse proxy or web server layer.
• Run the FuelCMS process under a least-privilege account with no shell access and restricted filesystem permissions.
• Deploy a web application firewall rule that rejects Installer requests containing shell metacharacters.
• Remove git and other command-line utilities from the runtime path of the web server where feasible.

# Example NGINX configuration to block external access to the Installer module
location ~* ^/(fuel/)?installer {
    allow 10.0.0.0/8;        # internal management network only
    deny  all;
    return 403;
}