CVE-2026-31313

Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences.

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to `unlink()` without path traversal or directory validation.

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not require the old password.

A missing authentication vulnerability was found in Feehi CMS up to version 2.1.1 in the REST API endpoint /api/articles. The attack can be performed remotely without authentication, and exploit details are publicly available.

A vulnerability has been found in Feehi CMS up to version 2.1.1 in the file /api/users of the API component. Unknown functionality of this file causes improper access controls, allowing remote attacks. The exploit has been published and may be used.