CVE-2026-86239
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability was identified in FeehiCMS up to version 2.1.1 in the UEditor Widget component, in the UeditorAction::init function of the file backend/widgets/ueditor/UeditorAction.php. The manipulation leads to unrestricted file upload. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
Unrestricted file upload could allow an attacker to upload a malicious file to the server, potentially leading to system compromise or arbitrary code execution.
Recommendation
It is recommended to immediately block access to the UEditor Widget component and monitor vendor updates. Also, restrict file upload capabilities to trusted users only.
Other vulnerabilities in FeehiCMS
See all- CVE-2026-51953High
FeehiCMS version 2.1.1 contains a vulnerability in the session management module, authentication logic, and logout handler components, allowing an attacker to escalate privileges.
- CVE-2025-65657Medium
FeehiCMS version 2.1.1 contains a remote code execution vulnerability via unrestricted file upload in the Ad Management module. An authenticated remote attacker can upload a crafted PHP file that the server later executes.
- CVE-2025-63523Medium
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
- CVE-2025-63522Medium
A Reverse Tabnabbing vulnerability exists in FeehiCMS 2.1.1 in the Comments Management function. Links opened in a new tab may allow control over the originating tab.
- CVE-2025-63520Medium
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Original NVD description (English source)
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS