CVE-2026-30462
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to perform directory traversal operations.
Risk Assessment
An attacker can gain unauthorized access to files outside the application's root directory, potentially leading to sensitive data leakage or further attack escalation.
Recommendation
Immediately update FuelCMS to the latest available version that fixes this vulnerability, and restrict access to the Blocks module to trusted users only.
Other vulnerabilities in FuelCMS
See all- CVE-2026-30458Critical
A vulnerability in FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
- CVE-2026-30457Critical
A vulnerability in the /parser/dwoo component of FuelCMS v1.5.2 allows attackers to execute arbitrary PHP code via crafted input.
- CVE-2026-30459High
An issue in the Forgot Password feature of FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
- CVE-2026-30461High
Daylight Studio FuelCMS version 1.5.2 was discovered to have an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php file and the add_git_submodule function.
- CVE-2026-30460High
Daylight Studio FuelCMS version 1.5.2 was found to have an authenticated remote code execution (RCE) vulnerability in the Blocks module. An attacker with a valid account can exploit this flaw to execute arbitrary code on the server.
- CVE-2026-30463High
A SQL injection vulnerability was discovered in Daylight Studio FuelCMS version 1.5.2 within the /controllers/Login.php component. An attacker can exploit this flaw to manipulate database queries.
Original NVD description (English source)
A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS