FeehiCMS CVE-2025-15264

Q: What is the CVSS score of CVE-2025-15264?

CVE-2025-15264 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2025-12-30 cna@vuldb.com

PHP SSRF Feehicms Feehi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible SSRF requiring no authentication; primary impact is confidentiality via internal resource enumeration, with no direct integrity or availability impact from SSRF alone.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:38 vuln.today

DescriptionCVE.org

A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the component TimThumb. Executing manipulation of the argument src can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in FeehiCMS 2.1.1 and earlier exposes the bundled TimThumb image-processing script to unauthenticated remote exploitation via a crafted src parameter. An attacker can coerce the application server to issue arbitrary HTTP requests, enabling enumeration of internal network services and cloud metadata endpoints. Exploit code has been publicly disclosed per VulDB submission 718278; EPSS remains very low at 0.04% (14th percentile) and no CISA KEV entry exists, suggesting limited opportunistic exploitation at time of analysis.

Technical ContextAI

FeehiCMS is a PHP-based content management system (CPE: cpe:2.3:a:feehi:feehicms:*:*:*:*:*:*:*:*). The application bundles TimThumb, a legacy PHP image-resizing utility with a long history of security weaknesses. The vulnerable file frontend/web/timthumb.php accepts an external src parameter specifying a source URL for image retrieval. Insufficient server-side validation of this parameter results in CWE-918 (Server-Side Request Forgery), where the server can be instructed to fetch arbitrary URLs - including those targeting RFC1918 private address ranges, loopback interfaces, or cloud instance metadata services such as 169.254.169.254. The root cause is the absence of an allowlist or blocklist restricting which hosts and schemes TimThumb may request on behalf of the caller.

RemediationAI

No vendor-released patch is available at time of analysis, and the vendor did not respond to responsible disclosure. The primary recommended control is to disable or remove frontend/web/timthumb.php from the web root, which eliminates the attack surface entirely - the trade-off is loss of any TimThumb-dependent image resizing functionality. If TimThumb functionality must be retained, implement strict egress filtering at the network or application layer to block server-initiated outbound HTTP and HTTPS requests to RFC1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata endpoints (169.254.169.254), noting this may break legitimate remote image fetching. Additionally, restrict access to timthumb.php via web server configuration - such as an Nginx location deny block or Apache .htaccess rule - to reduce unauthenticated exposure. Monitor VulDB entry 338663 and the FeehiCMS repository for any future patches.