CVE-2021-38290: Thedaylightstudio Fuel CMS

High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days.

A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.

Affected products

• Thedaylightstudio Fuel CMS: up to and including 1.5.0

Published 2021-08-09. Last modified 2026-06-17.