CVE-2026-86240

MediumCVSS 4.7

Published: 07/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 07/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

31th percentile - higher than 31% of all known CVEs

Summary

A security flaw was discovered in liufee FeehiCMS up to 2.1.1. The affected function is catchImage in the file backend/widgets/ueditor/Uploader.php (UEditor component). Manipulation of the source[] argument results in server-side request forgery. The attack can be executed remotely, and the exploit has been released publicly. The project has not responded yet.

Risk Assessment

An attacker may send requests to internal network resources, potentially leading to data disclosure or attacks on other systems. Remote attack increases the risk.

Recommendation

Update to a patched version or manually secure URL validation. Monitor the project for a response.

Other vulnerabilities in liufee FeehiCMS

CVE-2026-86241Medium
A weakness was identified in liufee FeehiCMS up to 2.1.1. The affected file is environments/prod/backend/config/main-local.php (Cookie Validation component). Manipulation of the cookieValidationKey argument causes use of a hard-coded cryptographic key. The attack can be carried out remotely, and the exploit has been made public. The project has not responded yet.

Original NVD description (English source)

A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS