The UeditorAction::init function in FeehiCMS’s UEditor widget allows an attacker to upload arbitrary files without any type or size restrictions. By sending a crafted request to this endpoint, a remote user can place files such as PHP scripts or other executable payloads onto the server. If those files are later served by the web application, the attacker can gain remote code execution, compromising the application and potentially the underlying host. The vulnerability stems from improper access control (CWE‑284) and missing file type validation (CWE‑434).

Affected software is liufee FeehiCMS up to and including version 2.1.1. The flaw resides in the backend/widgets/ueditor/UeditorAction.php file of the UEditor widget component.

The CVSS score of 6.9 indicates moderate severity. No EPSS value is available, but the public availability of an exploit and the ability to trigger the upload from any remote user increase the risk, especially for publicly accessible installations. The flaw can be exercised remotely by sending a specially crafted request to the init action, allowing the attacker to upload files that may be later executed.