CVE-2026-95265: SSRF
Published Oct 5, 2026
·Updated
Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences.
Affected Software
1 affected component
Feehi Feehi CMS=2.1.1
Event History
Oct 5, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
Description
Frequently Asked Questions
1
Which systems are exposed to this issue?
Feehi CMS 2.1.1 instances with the UEditor catchimage endpoint reachable by an attacker are exposed. The issue specifically permits requests to loopback and link-local addresses that are not blocked by the endpoint's private-IP validation.
2
What can an attacker do with this vulnerability?
An attacker can cause the CMS server to probe internal HTTP services via the catchimage endpoint. They can infer service behavior from differences in the returned responses.