Description
A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-08
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is located in the write_translations function of Feng Office’s Translation Tool. An attacker can manipulate the lang argument to inject PHP code, which the application then executes. This code injection allows a remote attacker to run arbitrary commands on the web server, compromising confidentiality, integrity, and availability of the system. The weakness is categorized as input validation and code injection (CWE-74 and CWE-94).

Affected Systems

Versions 3.11.13.11 and 4.2.1.2 of Feng Office are affected. Any deployment that includes the Translation Tool component and the vulnerable write_translations function is susceptible.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate base severity, but the remote nature of the attack and demonstrated public exploit evidence raise the practical risk. The EPSS score is not available, yet the existence of a publicly published exploit demonstrates that the vulnerability is actively abused. The vulnerability is not listed in CISA KEV, but the potential for remote code execution warrants significant attention.

Generated by OpenCVE AI on November 9, 2026 at 00:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest official patch or upgrade Feng Office to a version that includes the fix for the write_translations function.
  • If a patch cannot be applied immediately, disable or restrict access to the Translation Tool component using configuration changes or web server access controls.
  • As a temporary workaround, modify the ToolController.class.php file to strictly validate or whitelist the lang parameter before it is used, preventing injected PHP code from executing.

Generated by OpenCVE AI on November 9, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 23:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection
First Time appeared Fengoffice
Fengoffice feng Office
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*
Vendors & Products Fengoffice
Fengoffice feng Office
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Fengoffice Feng Office
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-08T23:15:19.222Z

Reserved: 2026-11-08T08:00:42.187Z

Link: CVE-2026-124499

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-09T00:18:00.990

Modified: 2026-11-09T00:18:01.150

Link: CVE-2026-124499

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T00:30:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')