CVE-2026-86239: liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered exposed?
FeehiCMS installations up to version 2.1.1 that include the UEditor Widget are affected. The vulnerable code is in backend/widgets/ueditor/UeditorAction.php, specifically UeditorAction::init.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction. Remote exploitation is possible.
Is exploit code available?
Yes. The vulnerability information states that a public exploit is available and might be used.
Is a vendor fix available?
No vendor response or fix is described. The project was notified through an issue report but had not responded at the time of the report.