CVE-2026-30462

Vulnerability

Overview CVE-2026-30462 describes a path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 [1]. The vulnerable code resides in fuel/modules/fuel/controllers/Blocks.php [2], where insufficient input sanitization allows attackers to manipulate file paths.

Exploitation

Attackers can exploit this by sending specially crafted HTTP requests that include directory traversal sequences (e.g., '../') to the Blocks module. No authentication is required, making the attack surface easily accessible from the network.

Impact

Successful exploitation enables attackers to read arbitrary files on the server, potentially exposing sensitive configuration files, database credentials, or other confidential data. This could lead to further compromise of the CMS and underlying system.

Mitigation

As of the publication date, no official patch has been released. Users should consider applying input validation filters to sanitize path parameters or restrict access to the Blocks module until a fix is available.