FearlessCMSの脆弱性で認証なしにファイル改ざん、0.1.4で修正

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn() authentication checks, CSRF protection or adequate path validation. On PHP's built-in development server, including the default Docker deployment, router.php checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so /./admin/ bypasses the admin login gate and executes those scripts directly. In admin/debug_save_flow.php, attacker-controlled path and content reach file_put_contents for arbitrary .md writes under content/ or outside it through path traversal, enabling site defacement and stored JavaScript in public pages; print_r($_POST) output without htmlspecialchars escaping also causes reflected cross-site scripting. The admin/debug_content.php path parameter reaches scandir(), file_get_contents() and posix_getpwuid(), permitting arbitrary directory enumeration and .md file reads that expose absolute paths, ownership, permissions, hashes and content previews. The admin/preview-handler.php endpoint accepts JSON content and title and writes enumerable files under content/_preview/, enabling stored cross-site scripting and disk exhaustion. The admin/testdebug.php endpoint appends to admin/testdebug.log without authentication, also enabling disk exhaustion. The admin/test_redirect.php sc…