Description
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-07
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Patch
AI Analysis

Impact

The vulnerability is a server‑side request forgery in the UEditor catchImage function caused by improper handling of the source[] parameter. By sending specially crafted requests, an attacker can force the CMS to initiate arbitrary HTTP requests to internal or external resources, potentially exposing sensitive data or facilitating further attacks. This flaw is categorized as CWE‑918 and can compromise the confidentiality and integrity of internal systems or services.

Affected Systems

Vendor liufee released FeehiCMS with the UEditor component. Versions up to and including 2.1.1 are affected. The flaw resides in backend/widgets/ueditor/Uploader.php used by the UEditor widget in FeehiCMS installations.

Risk and Exploitability

The CVSS score is 5.1, indicating a moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit was released publicly and can be triggered remotely by an unauthenticated user who can reach the catchImage endpoint. Since no authentication is required and the attack path involves an HTTP request to the server, the potential for abuse is significant if internal network services are reachable.

Generated by OpenCVE AI on September 7, 2026 at 02:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to FeehiCMS version 2.1.2 or later, or apply the vendor‑supplied patch that validates or removes the source[] parameter in UEditor’s catchImage routine.
  • If an upgrade is not immediately possible, restrict direct web access to the catchImage endpoint by IP whitelisting or moving the endpoint behind a VPN.
  • Implement input validation or a web‑application firewall rule that blocks requests containing non‑URL or disallowed URLs in the source[] argument to prevent SSRF.

Generated by OpenCVE AI on September 7, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Feehi
Feehi feehicms
Vendors & Products Feehi
Feehi feehicms

Mon, 07 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery
First Time appeared Liufee
Liufee feehicms
Weaknesses CWE-918
CPEs cpe:2.3:a:liufee:feehicms:*:*:*:*:*:*:*:*
Vendors & Products Liufee
Liufee feehicms
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Feehi Feehicms
Liufee Feehicms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T13:38:50.958Z

Reserved: 2026-09-06T08:59:18.126Z

Link: CVE-2026-86240

cve-icon Vulnrichment

Updated: 2026-09-08T13:38:47.790Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T02:17:20.890

Modified: 2026-09-08T14:17:32.903

Link: CVE-2026-86240

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T07:45:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)