CVE-2026-95264 in Feehi
Summary
by MITRE • 10/06/2026
Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to `unlink()` without path traversal or directory validation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Feehi CMS version 2.1.1 represents a critical security flaw classified as a Directory Traversal, which allows an authenticated attacker with specific privileges to manipulate the underlying file system of the web server. This issue stems from improper input validation and sanitization mechanisms within the application's backend administration interface. Specifically, when an authorized user attempts to edit or manage articles, the system processes metadata associated with article images. The code constructs a filesystem path using this untrusted data and directly passes it to the PHP unlink function without performing any checks for directory traversal sequences such as dot-dot-slash sequences or absolute path injections. This lack of validation means that an attacker can manipulate the file path variable to reference files outside the intended directory structure, effectively bypassing access controls designed to restrict file operations to specific application directories.
From a technical perspective, this flaw is rooted in CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability arises because the developer failed to implement strict allow-list validation or canonicalization checks on the user-supplied input before it was used for filesystem operations. In PHP environments, functions like unlink operate directly on the operating system's file layer if given a valid path string. By not restricting the scope of this operation to a predefined root directory, the application exposes itself to arbitrary file deletion. An attacker with article edit permissions can craft malicious requests that include relative or absolute paths pointing to sensitive configuration files, database credentials, source code backups, or other critical system resources. This capability transforms what might seem like a minor administrative function into a powerful vector for remote code execution or complete site compromise if combined with other vulnerabilities such as file upload flaws where an attacker can first place a web shell and then use this traversal to delete security controls that would otherwise detect it.
The operational impact of this vulnerability is severe, particularly in shared hosting environments or when the PHP process runs with elevated privileges. The ability to delete arbitrary files writable by the PHP process means that attackers can disrupt service availability by removing essential application files, leading to denial of service conditions for legitimate users. More critically, if sensitive configuration files containing database passwords or API keys are deleted, it may cause system instability or force administrators into a recovery mode where they might inadvertently expose more information during troubleshooting. In worst-case scenarios, deleting security-related logs can hinder incident response efforts by removing evidence of the attack vector used. The vulnerability also undermines data integrity, as critical business content stored in non-standard locations could be permanently lost if an attacker targets those specific paths through crafted metadata inputs.
Mitigation strategies must focus on implementing robust input validation and enforcing strict path restrictions at the application level. Developers should ensure that all file paths are canonicalized before use, resolving any symbolic links or relative references to their absolute forms, and then verifying that the resulting path resides within an expected base directory. This technique, often referred to as chrooting logic in memory, ensures that even if traversal sequences are present, they cannot escape the designated sandboxed area. Additionally, implementing a strict allow-list for permitted file extensions and characters can further reduce the attack surface. It is also advisable to run the PHP process with minimal necessary permissions, adhering to the principle of least privilege, so that even if an attacker succeeds in deleting files, they are limited to those within the web root or specific upload directories rather than system-wide paths. Regular security audits and static code analysis tools configured to detect unsafe file operations can help identify such flaws before deployment.
This vulnerability aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, as it enables an attacker to explore the filesystem structure through error messages or successful deletions of known files. It also relates to T1485: Destruction of Data, given its potential for permanent file removal. Organizations using Feehi CMS should immediately apply any available patches from the vendor if provided. In the absence of a patch, temporary mitigations include restricting backend access via IP whitelisting or multi-factor authentication and monitoring server logs for unusual patterns of file deletion requests originating from authenticated sessions with article editing privileges. Continuous monitoring and logging of filesystem changes can also aid in early detection of exploitation attempts.