Daylight Studio FuelCMS version 1.5.2 contains an authenticated remote code execution flaw in the Installer controller’s add_git_submodule function. Because the function uses user input to drive git commands, an attacker who authenticates to the application can trigger arbitrary code execution on the host. The vulnerability aligns with automated code execution weaknesses such as CWE‑77 command injection, where malicious input controls system commands.

The only affected product documented in the CVE entry is Daylight Studio FuelCMS version 1.5.2; no additional vendor or product variations are listed.

The flaw requires valid credentials for exploitation, meaning an attacker must first authenticate to the application. Once authenticated, the exploit can be performed by sending a crafted request to the /controllers/Installer.php endpoint that calls add_git_submodule. The CVSS score of 8.3 marks it as a high‑severity remote code execution vulnerability, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. It is not listed in CISA’s Known Exploited Vulnerabilities catalog, so no immediate public exploitation evidence exists.