A flaw in the Dwoo parser component of FuelCMS permits an attacker to inject and execute arbitrary PHP code. This vulnerability is a classic code‑execution weakness (CWE‑94). If exploited, an attacker could gain full control over the affected web server, read sensitive data, modify files, or pivot to other systems within the network, jeopardizing confidentiality, integrity, and availability of the application and any underlying infrastructure.

The vulnerability resides in Daylight Studio FuelCMS version 1.5.2 and the Dwoo library version 1.1.0. Administrators managing these versions of FuelCMS should verify that they are not using the default parser configuration that permits untrusted PHP code rendering.

The CVSS score of 9.8 indicates high severity, and the EPSS score (<1%) suggests low current exploit probability, although the lack of a known exploitation example does not diminish the risk. The vulnerability is not listed in the CISA KEV catalog yet, meaning it may be a new or under‑reported issue. Based on the description, the likely attack vector is remote via the web interface that processes user input through the Dwoo parser, allowing crafted PHP code to be embedded and executed on the server.