CVE-2026-86240 in FeehiCMS
Summary
by MITRE • 09/07/2026
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The discovery of a critical security vulnerability within liufee FeehiCMS, specifically affecting versions up to 2.1.1, highlights significant risks associated with third-party content management systems and their integrated components. The flaw resides in the UEditor component, which is widely used for rich text editing functionalities on web platforms. Specifically, the vulnerability impacts the catchImage function located within the backend/widgets/ueditor/Uploader.php file. This particular code path is responsible for handling image uploads by fetching images from external sources provided by users or administrators. The core issue stems from how this function processes the source argument, which allows an attacker to manipulate input data in a way that bypasses intended security controls.
The technical nature of this flaw constitutes a Server-Side Request Forgery vulnerability. In typical operations, the catchImage function is designed to retrieve images from URLs provided by users and save them locally for display within the CMS. However, due to insufficient validation or sanitization of the source parameter, an attacker can inject maliciously crafted URLs that direct the server to make requests to arbitrary destinations. This capability allows a remote attacker to force the vulnerable application's backend server to send HTTP requests to internal network resources, external services, or other systems that would otherwise be inaccessible from the public internet. The absence of proper access control checks on these outbound requests is the primary technical deficiency enabling this exploitation vector.
The operational impact of this vulnerability extends beyond simple data leakage. Because the exploit has been released publicly and can be executed remotely without authentication in many configurations, it poses a severe threat to system integrity and confidentiality. Attackers can leverage this flaw for internal network reconnaissance by probing ports and services within the local network segment where the CMS is hosted. Furthermore, if the server runs with elevated privileges or has access to sensitive backend APIs, the attacker could potentially interact with those resources directly through forged requests. This often serves as a stepping stone for more severe attacks, such as accessing cloud metadata endpoints like AWS EC2 instance metadata service (IMDSv1) to steal credentials, or interacting with internal microservices that lack proper authentication mechanisms when accessed from localhost.
From an industry standards perspective, this vulnerability aligns closely with CWE-918 Server-Side Request Forgery and falls under the MITRE ATT&CK technique T1557, which covers Adversary-in-the-Middle scenarios where attackers use SSRF to intercept or manipulate communications between internal systems. The lack of response from the project maintainers despite early notification exacerbates the risk profile for users who have not yet applied mitigations. In such cases, reliance on automatic updates is not viable, necessitating manual intervention by system administrators and security teams responsible for maintaining these environments.
To mitigate this vulnerability, immediate action is required to patch or upgrade the liufee FeehiCMS installation if a fixed version becomes available from alternative sources or community forks that have addressed the issue. In the interim, network-level controls should be implemented to restrict outbound HTTP requests from the web server application user account. This can include configuring firewall rules to block access to internal IP ranges and cloud metadata endpoints such as 169.254.169.254 for AWS or similar addresses for other providers. Additionally, input validation on the UEditor component should be strengthened by whitelisting allowed domains for image sources rather than allowing arbitrary URLs. Deploying a Web Application Firewall with rules specifically designed to detect and block SSRF payloads can also provide an additional layer of defense against exploitation attempts while permanent fixes are being developed or applied.