PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-30457 Daylight Studio CVE debrief

CVE-2026-30457 is a critical vulnerability in Daylight Studio FuelCMS v1.5.2. The issue lies in the /parser/dwoo component, allowing attackers to execute arbitrary code via crafted PHP code. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL. This vulnerability can lead to full control of the affected system if exploited. Users of Daylight Studio FuelCMS v1.5.2 should prioritize patching this vulnerability to prevent potential code execution attacks. The CVE record and NVD entry provide further details on this vulnerability.

Vendor
Daylight Studio
Product
FuelCMS
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-26
Original CVE updated
2026-07-05
Advisory published
2026-03-26
Advisory updated
2026-07-05

Who should care

Users of Daylight Studio FuelCMS v1.5.2, administrators, and security teams should prioritize patching this vulnerability to prevent potential code execution attacks. Affected operators and platforms should review system configurations and verify potential exposures. Vulnerability management and security teams should ensure that the latest version of FuelCMS is used and review system logs for potential suspicious activity.

Technical summary

The vulnerability is located in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2. It allows attackers to execute arbitrary PHP code, potentially leading to full control of the affected system. The issue is exacerbated by its critical CVSS score of 9.8, indicating a high severity level. This vulnerability can be exploited by sending crafted PHP code to the /parser/dwoo component, which can lead to code execution. Users should be cautious and ensure that they are using the latest version of FuelCMS.

Defensive priority

High

Recommended defensive actions

  • Apply the latest patches or updates provided by the vendor.
  • Restrict access to the /parser/dwoo component to trusted users only.
  • Implement additional security measures such as Web Application Firewalls (WAFs) to detect and prevent suspicious traffic.
  • Regularly review and update the FuelCMS installation to ensure the latest security patches are applied.
  • Consider using a vulnerability scanner to identify potential weaknesses in the system.

Evidence notes

The CVE record was published on 2026-03-26T19:16:59.900Z and last modified on 2026-07-05T17:17:28.677Z. The NVD entry is currently Modified. The vulnerability affects Daylight Studio FuelCMS v1.5.2. Evidence is limited to CVE and NVD entries. Defenders should verify system configurations and review for potential exposures.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-26T19:16:59.900Z and has not been modified since then. The NVD entry is currently Modified.