Description
A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-08
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Server-side request forgery (SSRF) allows remote attackers to compel the vulnerable server to make arbitrary HTTP requests on their behalf
Action: Patch Immediately
AI Analysis

Impact

This vulnerability resides in the upload_document_image function of the File Handler component of Feng Office up to versions 3.11.13.11 and 4.2.1.2. Modifying the url argument enables an attacker to trigger server‑side request forgery, giving remote actors the ability to instruct the application server to send arbitrary requests and potentially access internal resources or exfiltrate data.

Affected Systems

The affected product is Feng Office, a document management system provided by Fengoffice. The flaw is present in versions up to 3.11.13.11 and 4.2.1.2. Users running these versions are susceptible.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The exploit has been released publicly and can be triggered remotely without authentication. With no mitigation from the vendor, the risk is elevated; attackers can leverage the SSRF to pivot into internal systems. The lack of a public patch and the remote nature of the attack vector mean that enterprises should consider immediate remediation.

Generated by OpenCVE AI on November 9, 2026 at 00:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to a version released after 3.11.13.11/4.2.1.2 once available
  • If the patch is not yet released, restrict the upload_document_image endpoint to authenticated administrators only and limit outbound requests to a whitelist of trusted domains
  • Implement network‑level filtering to block outbound HTTP requests from the application server to internal or untrusted addresses, mitigating the SSRF impact
  • Validate and sanitize the url parameter server‑side to reject malformed or disallowed URLs, reducing the risk of SSRF if future vulnerabilities arise

Generated by OpenCVE AI on November 9, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Fengoffice Feng Office File FilesController.class.php upload_document_image server-side request forgery
First Time appeared Fengoffice
Fengoffice feng Office
Weaknesses CWE-918
CPEs cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*
Vendors & Products Fengoffice
Fengoffice feng Office
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Fengoffice Feng Office
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-08T23:30:20.791Z

Reserved: 2026-11-08T08:01:25.653Z

Link: CVE-2026-124500

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-09T00:18:01.200

Modified: 2026-11-09T00:18:01.353

Link: CVE-2026-124500

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T00:30:08Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)