An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.
References
| Link | Resource |
|---|---|
| http://daylight.com | Not Applicable |
| http://fuelcms.com | Product |
| https://github.com/daylightstudio/FUEL-CMS/tree/master/fuel/modules/fuel/libraries/parser/dwoo | Product |
| https://pentest-tools.com/PTT-2025-026-PHP-Code-Execution-Via-Dwoo-Escape.pdf | Third Party Advisory Exploit |
Configurations
Configuration 1 (hide)
|
History
30 Mar 2026, 14:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:thedaylightstudio:dwoo:1.1.0:*:*:*:*:*:*:* cpe:2.3:a:thedaylightstudio:fuel_cms:1.5.2:*:*:*:*:*:*:* |
|
| First Time |
Thedaylightstudio dwoo
Thedaylightstudio Thedaylightstudio fuel Cms |
|
| References | () http://daylight.com - Not Applicable | |
| References | () http://fuelcms.com - Product | |
| References | () https://github.com/daylightstudio/FUEL-CMS/tree/master/fuel/modules/fuel/libraries/parser/dwoo - Product | |
| References | () https://pentest-tools.com/PTT-2025-026-PHP-Code-Execution-Via-Dwoo-Escape.pdf - Third Party Advisory, Exploit |
Information
Published : 2026-03-26 19:16
Updated : 2026-03-30 14:11
NVD link : CVE-2026-30457
Mitre link : CVE-2026-30457
CVE.ORG link : CVE-2026-30457
JSON object : View
Products Affected
thedaylightstudio
- fuel_cms
- dwoo
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')