CVE-2026-30461 daylightstudio CVE debrief

Who should care

Users of FuelCMS 1.5.2, particularly those responsible for the security of FuelCMS installations, should be aware of this authenticated remote code execution vulnerability. The vulnerability has a CVSS score of 8.3 and a severity of HIGH, indicating a high level of risk. Security teams and vulnerability management teams should prioritize patching this vulnerability.

Technical summary

The vulnerability exists in the /controllers/Installer.php file and specifically in the add_git_submodule function of FuelCMS 1.5.2. This function allows for authenticated remote code execution. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. This CVE record was published on 2026-04-15T16:16:36.050Z and was last modified on 2026-07-05T17:17:29.290Z. Users should be cautious of this vulnerability as it allows for remote code execution.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and the potential for remote code execution. The vulnerability allows for authenticated remote code execution, which can lead to significant damage if exploited.

Recommended defensive actions

• Apply the patch or update to a fixed version of FuelCMS
• Restrict access to the /controllers/Installer.php file
• Monitor for suspicious activity related to the add_git_submodule function
• Implement additional security measures to prevent remote code execution
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. The source item URL provides additional information on the vulnerability. The product reference provides information on the affected product. Evidence is limited to publicly available information and may not be comprehensive. Defenders should verify the vulnerability and affected scope in their specific environments.

Official resources