CVE-2026-105290: feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What versions are known to be affected?
The reported affected version is feelec-yishu feelcrm-os 1.0.0. No fixed version or vendor patch is identified in the available information.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated. The vulnerability is remotely exploitable by manipulating the url argument handled by the getCurlData endpoint.
How likely is exploitation in practice?
Public exploit disclosure is reported, and the attack complexity is rated low. This means systems exposing the affected endpoint should be treated as having a realistic exploitation risk.
What can be done if a patch is not available?
The available information does not identify a vendor fix. Limit remote access to the affected application or endpoint where operationally possible, and restrict the application's outbound network access to reduce SSRF reachability.