CVE-2026-95265

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: MITRE

Description

Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95265

EUVD

EUVD-2026-92781

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Feehi CMS 2.1.1 has a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation fails to block loopback or link-local addresses, allowing attackers to make the server probe internal HTTP services by observing response differences.

Detection Guidance

To detect this SSRF vulnerability in Feehi CMS 2.1.1, monitor network traffic for unusual internal requests originating from the UEditor catchimage endpoint. Check server logs for requests to loopback or link-local addresses like 127.0.0.1 or 169.254.0.0/16. Use tools like curl to test the endpoint manually: curl -v 'http://your-cms-domain.com/backend/web/static/js/plugins/ueditor/php/controller.php?action=crawler&source=http://127.0.0.1:9090/' and observe if the server responds differently to internal vs external requests.

Inspect the files mentioned in the vulnerability report: backend/web/static/js/plugins/ueditor/php/controller.php, action_crawler.php, and Uploader.class.php for improper IP validation logic.

Impact Analysis

An unauthenticated attacker can exploit this by sending crafted requests to probe internal services. This may lead to information disclosure about internal network services, potential access to sensitive data, or enabling further attacks on internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Information disclosure may result in non-compliance with confidentiality and security controls mandated by these regulations.

Mitigation Strategies

Immediately update Feehi CMS to the latest version if available. If not, apply input validation to the UEditor catchimage endpoint to block loopback (127.0.0.0/8), link-local (169.254.0.0/16), and private IP ranges. Restrict server access to internal services and implement network segmentation. Monitor logs for suspicious activity targeting internal addresses.

Hi! I’m here to help you understand CVE-2026-95265. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70