EUVD-2026-92774
GHSA-f8wx-vh68-3c39
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySend crafted request to UploadTicketFile endpoint
-
ExploitManipulate 'cmd' argument to bypass upload checks
-
ExecutionUpload arbitrary file to server
-
ImpactAccess uploaded file for limited impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged session (CVSS PR:L) with access to the UploadTicketFile endpoint in App/Feelcrm/Crm/Controller/UploadController.class.php. The attack specifically manipulates the 'cmd' argument to perform an unrestricted file upload; no user interaction is needed (UI:N) and it is exploitable remotely over the network (AV:N). Limiting factors: the attacker must first hold valid credentials for feelcrm-os, and exploitation is confined to version 1.0.0 of this specific, narrowly-deployed CRM product. |
| Impact | This is a low-priority issue despite being a file-upload flaw (CWE-434). The vendor/VulDB CVSS 4.0 base score is only 2.1, and the vector (AV:N/AC:L/AT:N/PR:L/UI:N) with uniformly LOW impact (VC:L/VI:L/VA:L) indicates limited technical impact rather than the full remote code execution often associated with unrestricted upload. PR:L confirms the attacker must be authenticated at a low privilege level, which meaningfully constrains exposure. The embedded SSVC/threat metric E:P (Proof-of-Concept) aligns with the stated public exploit, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread or automated exploitation - exploitation status is 'publicly available exploit code exists', which is distinct from active exploitation. Signals are largely consistent, but note a tension worth verifying: the LOW impact rating seems conservative for an 'unrestricted upload' primitive, which can frequently escalate to webshell-based code execution; the real impact may be higher than the score suggests and should be verified against the actual upload handler behavior. Overall, a single-source (VulDB) low-severity finding in an obscure product - monitor, not urgent. |
| Exploit ScenarioDerived | A low-privileged authenticated user sends a crafted request to the UploadTicketFile endpoint, manipulating the 'cmd' argument to bypass file-type restrictions and upload an arbitrary (potentially malicious) file to the feelcrm-os server. A public proof-of-concept exists (referenced via the vendor's GitHub issue tracker), lowering the effort required to reproduce. Because the CVSS vector reports only low impact, the immediate payoff is limited, though an uploaded server-side script could potentially be leveraged for further action. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Unrestricted file upload in feelec-yishu FeelCRM-OS 1.0.0 allows an authenticated, low-privileged user to write arbitrary files to the server through the UploadTicketFile endpoint at App/Feelcrm/Crm/Controller/UploadController.class.php by manipulating the cmd argument. The issue is reachable remotely over the network, requires no user interaction, and publicly available exploit code exists, but exploitation is gated on holding a valid low-privileged account (CVSS PR:L) and is confined to version 1.0.0 of this narrowly deployed CRM product, so overall risk is low. The vendor/project was notified through an issue report and has not responded, and there is no indication of confirmed active exploitation (no CISA KEV listing).
RemediationAI
No vendor-released patch identified at time of analysis: the project was reportedly informed via GitHub issue 7 (https://github.com/feelec-yishu/feelcrm-os/issues/7) and has not responded, and the advisory at https://vuldb.com/vuln/413583 lists no fixed version, so administrators must rely on compensating controls. The highest-value mitigation is to restrict access to the UploadTicketFile endpoint in App/Feelcrm/Crm/Controller/UploadController.class.php to trusted roles only and to require re-authentication for uploads, accepting that this may disrupt normal ticket-attachment workflows. Enforce strict server-side validation on any uploaded file (allow-list of safe extensions and MIME types, reject PHP and other executable extensions, sanitize the 'cmd' argument against a fixed set of permitted values), and store uploads outside the web root and disable script execution (e.g., php_admin_flag engine off or equivalent) in any directory that must remain web-accessible; the trade-off is that legitimate file delivery may require an application-level download handler. Because exploitation requires a valid low-privileged session, tighten account provisioning and monitor for anomalous POST requests to the upload route as a detective control, and consider a reverse-proxy or WAF rule blocking suspicious multipart uploads to that path as a short-term stopgap. If FeelCRM-OS is internet-facing and not essential, taking it offline or placing it behind VPN-only access removes the exposure entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-434 unrestricted upload in a PHP application: the UploadController's ticket-file upload handler in FeelCRM-OS 1.0.0 accepts an attacker-influenced 'cmd' argument, which the code uses without adequately validating the file's type, extension, or target path. Because the parameter governs how the uploaded artifact is processed or where it is placed, an authenticated user who can reach the UploadTicketFile endpoint can deposit files of their choosing on the server, potentially including PHP scripts that would execute if the upload directory is web-reachable. The CPE cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:* marks the whole feelcrm-os product line in the affected range, with the disclosed instance being 1.0.0. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) confirms network reachability, low privileges required, no user interaction, and limited confidentiality, integrity, and availability impact, consistent with an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The CPE-to-endpoint correlation matters: exploitation is not a generic PHP upload bug but is tied specifically to the UploadTicketFile route in this custom CRM module.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote authenticated low-priv upload (AV:N/AC:L/PR:L/UI:N); impact kept LOW to match the source rating despite unrestricted-upload potential for greater I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB