CVE-2025-65657
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
FeehiCMS version 2.1.1 contains a remote code execution vulnerability via unrestricted file upload in the Ad Management module. An authenticated remote attacker can upload a crafted PHP file that the server later executes.
Risk Assessment
An attacker with a valid account can achieve remote code execution on the server, leading to full compromise of the application and potentially the host. This may result in data leakage, content modification, or further escalation.
Recommendation
Update FeehiCMS to a patched version, restrict uploads of executable files, and review administrative account permissions.
Other vulnerabilities in FeehiCMS
See all- CVE-2026-86239Medium
A vulnerability was identified in FeehiCMS up to version 2.1.1 in the UEditor Widget component, in the UeditorAction::init function of the file backend/widgets/ueditor/UeditorAction.php. The manipulation leads to unrestricted file upload. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-51953High
FeehiCMS version 2.1.1 contains a vulnerability in the session management module, authentication logic, and logout handler components, allowing an attacker to escalate privileges.
- CVE-2025-63523Medium
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
- CVE-2025-63522Medium
A Reverse Tabnabbing vulnerability exists in FeehiCMS 2.1.1 in the Comments Management function. Links opened in a new tab may allow control over the originating tab.
- CVE-2025-63520Medium
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Original NVD description (English source)
FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS