The vulnerability is a Server‑Side Request Forgery in the UEditor catchimage endpoint of Feehi CMS 2.1.1. The endpoint fetches images from supplied URLs, but the private‑IP validation intended to block loopback and link‑local addresses is missing. This omission allows an attacker to cause the server to send requests to internal resources, potentially revealing the presence or absence of internal HTTP services through observable response differences.

Only installations of Feehi CMS version 2.1.1 are affected. The catchimage handler is present in this distribution; no other versions or related products have been reported to contain the flaw.

The flaw permits external input to trigger server‑initiated outbound HTTP requests, making it a remote attack vector via a normal HTTP request to the vulnerable endpoint. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, indicating that widely available exploits are unlikely at present. However, the malicious requests could enable internal network reconnaissance or further attacks against exposed internal services. The CVSS score of 7.5 indicates high severity, and the attack can be performed without authentication if the catchimage endpoint is accessible from the Internet.