CVE-2026-86240: liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects liufee FeehiCMS through version 2.1.1 where the UEditor component and its Uploader.php catchImage functionality are present.
What access does an attacker need to exploit this?
The vulnerability can be exploited remotely by manipulating the source[] argument handled by catchImage. The provided data does not state that authentication is required.
Is public exploit information available?
Yes. An exploit has been publicly released and may be used in attacks.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of disclosure.