CVE-2026-86239 in FeehiCMS
Summary
by MITRE • 09/07/2026
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in liufee FeehiCMS versions up to 2.1.1 represents a critical security flaw within the UEditor Widget component, specifically located in the init function of the backend/widgets/ueditor/UeditorAction.php file. This architectural weakness allows for unrestricted file uploads, which is one of the most severe categories of web application vulnerabilities. The core technical issue stems from insufficient validation and sanitization mechanisms when handling user-supplied input during the initialization process of the UEditor rich text editor widget. Because the system fails to adequately verify the type, content, or destination path of uploaded files, an attacker can bypass standard security controls that are typically designed to prevent malicious code execution on a web server.
From a technical perspective, this flaw aligns with CWE-434, which describes the ability to upload and execute arbitrary files, as well as CWE-79, regarding improper neutralization of input during web page generation if the uploaded content is rendered directly. The lack of strict file extension filtering or MIME type verification enables an adversary to upload executable scripts such as PHP shells, ASPX payloads, or other server-side code interpreters. Since this vulnerability resides in a backend widget that may be accessible through administrative interfaces or potentially exposed endpoints depending on the CMS configuration, it provides a direct pathway for remote exploitation. The presence of publicly available exploits significantly lowers the barrier to entry for attackers, allowing them to leverage automated tools rather than requiring custom development skills to compromise the target system.
The operational impact of this vulnerability is severe and multifaceted. Successful exploitation grants an attacker full control over the web server's file system through the uploaded script. This typically leads to complete site defacement, data exfiltration from associated databases, or further lateral movement within the internal network if the compromised host serves as a pivot point. In many cases, attackers use these backdoors for cryptomining operations, spam distribution, or hosting phishing pages that leverage the trust users place in the legitimate domain. The fact that the project maintainers have not yet responded to early issue reports exacerbates the risk landscape, leaving administrators without official patches or guidance on how to mitigate this specific flaw within their existing deployments.
Mitigation strategies must be implemented immediately given the high severity and availability of exploits. Administrators should prioritize upgrading FeehiCMS to a patched version as soon as it becomes available from the vendor. In the interim, if an upgrade is not feasible, defensive measures include restricting file upload directories by disabling script execution permissions at the web server level using configurations such as Apache's mod_rewrite or Nginx location blocks that deny access to executable extensions like .php, .asp, or .exe in user-uploaded folders. Additionally, implementing a Web Application Firewall with rules specifically targeting UEditor-related endpoints and file upload anomalies can provide an additional layer of defense by blocking known exploit patterns associated with this vulnerability. Continuous monitoring for unusual file creation events in the backend widget directories is also recommended to detect potential compromise attempts early.