Daylight Studio FuelCMS version 1.5.2 contains an authenticated remote code execution flaw in the Installer controller’s add_git_submodule function. Because the function accepts user input that can influence the execution of git commands, an attacker who authenticates to the application can trigger arbitrary code execution on the host. The weakness aligns with automated code execution vulnerabilities as defined in CWE‑94, where malicious input leads to compromised execution flow.

The only affected product listed is Daylight Studio FuelCMS version 1.5.2. No additional vendor or product variations are documented in the CVE entry.

The vulnerability is authenticated, meaning an attacker must first gain valid credentials for the application. Once authenticated, the exploit can be performed by sending a crafted request to the /controllers/Installer.php endpoint that invokes add_git_submodule. Because no EPSS score is available and the CISA Known Exploited Vulnerabilities catalog does not list the issue, the publicly measured likelihood of exploitation is unknown. The CVSS metric, if provided elsewhere, would rate it as high due to remote code execution, but the lack of additional data suggests relying on the authenticated nature to gauge operational risk.