CVE-2018-16763: FUEL CMS pre-auth PHP code evaluation leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityPre-auth network-reachable RCE with public exploits and very high EPSS probability makes this an urgent patch target.

What it is

FUEL CMS 1.4.1 evaluates attacker-supplied PHP through the pages/select/ filter parameter and the preview/ data parameter. Because the injection reaches code evaluation before authentication, it results in pre-auth remote code execution. The flaw is trivially reachable over the network and gives full control of the affected host.

Impact

An unauthenticated attacker can execute arbitrary PHP and operating system commands on the web server, leading to full compromise of the application and its data.

Attack surface

Reachable over HTTP through the pages/select/ filter parameter or the preview/ data parameter; the CVSS vector shows network access with no privileges and no user interaction required.

Exploitation

Multiple public exploit references exist (Packet Storm, Exploit-DB 47138, and a bypass writeup), and EPSS is 0.82937 (99.7th percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade FUEL CMS past 1.4.1 to a release containing the fix referenced in the project issue tracker.
• If upgrade is not possible, remove or block access to the pages/select/ and preview/ endpoints at the web server or WAF.
• Restrict administrative and preview functionality to trusted networks or authenticated users only.
• Run the CMS under a least-privilege service account with PHP execution restrictions (disable_functions, open_basedir) to limit post-exploitation impact.

Detection

• Monitor web logs for requests to pages/select/ or preview/ containing PHP function names, eval, or base64-encoded payloads.
• Alert on outbound connections or child processes spawned by the web server user (e.g., shell, curl, wget).
• Search for unexpected PHP files or modified CMS files under the web root.
• Correlate repeated 200 responses to the vulnerable parameters from a single source with subsequent command execution artifacts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.