This is a Remote Code Execution (RCE) vulnerability found in FuelCMS. An attacker can execute arbitrary code by sending malicious PHP code via the `data` parameter of the `/fuel//preview?module=blocks&field=view` endpoint.
Although the vulnerability was reported to the vendor, no patch has been released yet.
AIWAAP plans to address this issue with the “2342 / Daylight Studio FuelCMS Remote Code Execution” pattern, which will be included in the September 2026 pattern update.
Tags: CVE-2026-30457, FuelCMS, Daylight Studio, Dwoo, PHP Code Execution, Remote Code Execution, Code Injection
---
1. Overview
FuelCMS (Daylight Studio) is an open-source content management system (CMS) based on PHP CodeIgniter that provides functionality for managing content such as pages, blocks, and navigation. This report summarizes the analysis of the CVE-2026-30457 vulnerability discovered in FuelCMS.
---
2. Attack Vector
This vulnerability allows an attacker to execute arbitrary PHP code by exploiting a validation flaw in the Dwoo template parser—which is designed to prevent the injection of malicious PHP code into FuelCMS—specifically a failure to validate backslash characters, thereby bypassing the Dwoo string constraints.
An attacker /fuel//preview?module=blocks&field=view send malicious PHP code containing backslashes via the endpoint’s `data` parameter, thereby bypassing the Dwoo template parser to execute the code.
For example, if the string `{assign(aaa\ 'bbb')}` is sent in the `data` parameter, the backslash escapes the single quote (`'`) in the string, causing the safe value ``'aaa\'`` to be expanded to ``'aaa\', '``, and the subsequent string “bbb” is interpreted as a T_STRING object, recognized as PHP code, and executed.
Attack Request:
POST /fuel//preview?module=blocks&field=view HTTP/1.1
Content-Length: 167
Content-Type: multipart/form-data; boundary=PieBoundary123456789012345678901234567
Host: www.test.com
User-Agent: HTTPie
--PieBoundary123456789012345678901234567
Content-Disposition: form-data; name="data"
{assign(aaa\'. die(`id`));//')}
--PieBoundary123456789012345678901234567--
---
3. Mitigation Measures
FuelCMS has not been updated for approximately four years. Although Pentest-Tools, the research team that discovered this vulnerability, reported it, no related patch had been released as of September 23, 2026.
At AIWAAP, we plan to address this issue with the “2342 / Daylight Studio FuelCMS Remote Code Execution” pattern, which will be included in the September 2026 pattern update.
Source: https://pentest-tools.com/PTT-2025-026-PHP-Code-Execution-Via-Dwoo-Escape.pdf
---
4. Conclusion
FuelCMS is a PHP-based open-source CMS. Regarding the CVE-2026-30457 vulnerability discovered in this CMS, detailed information and a proof-of-concept (PoC) have already been disclosed, and since a patch for this vulnerability has not yet been released, the risk level is high.
MonitorLab is actively monitoring vulnerabilities in FuelCMS and plans to respond promptly to any related vulnerabilities discovered in the future.
---
