Feng Office CVE-2026-36669
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote upload (AV:N/AC:L/PR:N/UI:N); impact rated lower because the demonstrated .html primitive yields content injection, not confirmed code execution or system integrity/availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/ directory.
AnalysisAI
Unauthenticated arbitrary file upload in Feng Office 3.11.13.11 lets remote attackers push attacker-controlled files (e.g. .html) into the web-accessible /tmp/ directory via the ck_upload_handler.php endpoint, with no authentication or user interaction. A public proof-of-concept exists on GitHub, and the CWE-434 flaw carries a CVSS 9.8, though EPSS remains low (0.46%, 37th percentile) and it is not in CISA KEV, indicating no confirmed in-the-wild abuse yet.
Technical ContextAI
Feng Office is an open-source PHP-based web collaboration and project-management suite. The vulnerable component, ck_upload_handler.php, is the upload handler associated with the CKEditor/file-attachment functionality and fails to enforce authentication or restrict file types/destinations - the classic CWE-434 'Unrestricted Upload of File with Dangerous Type' pattern. Because uploaded content lands in a web-accessible /tmp/ path, an attacker can retrieve or trigger the file directly over HTTP. Whether server-side script types (e.g. .php) execute depends on how /tmp/ is served; the description explicitly cites .html, which reliably yields attacker-hosted content (stored XSS, phishing, drive-by pages) even if PHP execution is filtered.
RemediationAI
No vendor-released patched version is identified in the provided data, so verify the latest release directly with Feng Office at https://www.fengoffice.com/ and upgrade beyond 3.11.13.11 once a fix is published; consult the PoC/advisory at https://github.com/firstlax6t/CVE-2026-36669-FengOffice for exploit specifics. As compensating controls, restrict or block network access to ck_upload_handler.php (for example via a WAF rule or web-server location block) so only authenticated sessions reach it, which may break legitimate CKEditor uploads. Ensure the /tmp/ upload directory is not web-accessible by removing it from the served document root or adding a server rule denying direct HTTP requests to it, and disable script execution (PHP handler) for that directory - both reduce the impact to at most inert file storage but may disable attachment previews. Enforce server-side file-type allowlisting and authentication on the handler if code changes are feasible.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today