CVE-2026-124499: Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection
A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function writetranslations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Feng Office versions up to 3.11.13.11 and 4.2.1.2 are identified as affected. The issue is in the Translation Tool component, specifically ToolController.class.php.
What access does an attacker need to exploit this issue?
The vulnerability can be initiated remotely, but the supplied CVSS vector indicates high privileges are required. Exploitation involves manipulating the lang argument passed to write_translations.
How urgent is remediation?
A public exploit is available, and the vendor did not respond to early disclosure contact. Prioritize affected instances where high-privilege accounts could be compromised or misused.
How can I check whether my instance may be vulnerable?
Identify the installed Feng Office version and determine whether the Translation Tool's ToolController.class.php includes the write_translations function handling the lang argument. Versions at or below the listed affected releases should be treated as potentially vulnerable.