CVE-2026-105389: feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable over the network and requires low-privileged access. No user interaction is required.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Which deployments are known to be affected?
The affected product identified in the available data is feelec-yishu feelcrm-os version 1.0.0, specifically processing associated with UploadController.class.php and the UploadTicketFile endpoint.
Is a vendor fix available?
No vendor response or fix is identified in the available data. The project was notified through an issue report but had not responded at the time of publication.