CVE-2026-86240

Name of the Vulnerable Software and Affected Versions liufee FeehiCMS versions prior to 2.1.2

Description A server-side request forgery exists in the UEditor component within the catchImage() function of the backend/widgets/ueditor/Uploader.php file. A remote attacker can exploit this by manipulating the source[] argument, allowing the server to make unauthorized requests to internal or external resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the catchImage() function in the backend/widgets/ueditor/Uploader.php file.