CVE-2026-8211
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Fess up to version 15.5.1 is vulnerable to code injection in the JSP File Handler component. The update function in AdminDesignAction.java does not sanitize the 'content' argument, allowing remote code injection. Exploit is public.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, leading to full system compromise.
Recommendation
Update Fess to a version newer than 15.5.1. If unavailable, apply temporary mitigations such as restricting access to the admin panel.
Original NVD description (English source)
A vulnerability was detected in codelibs Fess up to 15.5.1. Affected by this issue is the function update of the file org/codelibs/fess/app/web/admin/design/AdminDesignAction.java of the component JSP File Handler. The manipulation of the argument content results in code injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.