CVE-2026-86239
Received Received - Intake

Unrestricted File Upload in FeehiCMS

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86239
EUVD
EUVD-2026-72187

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
liufee feehi_cms to 2.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthorized arbitrary file upload flaw in FeehiCMS version 2.1.1 and earlier. It exists in the UEditor component due to a misconfigured access control whitelist that allows unauthenticated access to file upload functions. Attackers can exploit this to upload malicious files without authentication, bypassing security controls.

Detection Guidance

Check for unauthorized file uploads in the UEditor component by inspecting the backend/config/main.php file for the 'assets/*' entry in the allowActions list. Look for suspicious files in the assets directory or any web-accessible upload folders. Monitor network traffic for unauthenticated POST requests to UeditorAction endpoints like uploadImage or uploadFile.

Impact Analysis

This vulnerability allows attackers to upload arbitrary files to your server without authentication. This could lead to malicious file execution, data theft, or serving malware to visitors. Attackers can also enumerate existing files, retrieve sensitive data, or use your server to host phishing content.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized file access, or malware distribution from your systems. Such incidents may violate GDPR's data protection requirements or HIPAA's security rules, potentially resulting in legal penalties, fines, or reputational damage due to non-compliance.

Mitigation Strategies

Remove the 'assets/*' entry from the backend AccessControl allowActions list in backend/config/main.php. Add authentication checks to all UEditor-related actions. Re-enable CSRF protection in UeditorAction::init(). Restrict file uploads to necessary extensions and implement MIME type validation. Review and remove any unauthorized files already uploaded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart