Unauthenticated File Upload in Feng Office

Executive Summary

CVE-2026-36669 is an unauthenticated arbitrary file upload vulnerability in Feng Office Community Edition version 3.11.13.11. The flaw exists in the ck_upload_handler.php script, which lacks authentication checks, allowing remote attackers to upload arbitrary files (including malicious .html or .php scripts) to a web-accessible directory. The vulnerability is exacerbated by inactive server-side file validation, which was designed to restrict uploads to image formats but has been commented out in the code.

This enables attackers to bypass restrictions and upload executable files. The script writes uploaded files directly to the /tmp/ directory, which is web-accessible, and the lack of HttpOnly flags on session cookies allows for Stored Cross-Site Scripting (XSS) attacks.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected files in the /tmp/ directory, especially .html or .php files. Monitor network traffic for POST requests to ck_upload_handler.php without authentication. Inspect server logs for unusual upload activities or requests to web-accessible directories.

Useful 0 Not Useful 0

Impact Analysis

Attackers can upload malicious files to the server, leading to potential execution of arbitrary code or scripts. This could result in unauthorized access to sensitive data, session hijacking, or theft of administrative credentials. For example, when an administrator views an uploaded malicious file, embedded scripts may execute in their session context.

The vulnerability also enables Stored Cross-Site Scripting (XSS) attacks, which can compromise user accounts and sensitive information. Attackers could leverage this to perform actions on behalf of users or escalate privileges within the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using the vulnerable version may face compliance violations, legal penalties, and reputational damage due to data breaches or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately enforce authentication on the ck_upload_handler.php endpoint. Re-enable and strengthen server-side file validation to block non-image uploads. Enable HttpOnly flags for session cookies to prevent XSS attacks. Consider temporarily disabling file uploads until patches are applied.

Useful 0 Not Useful 0