FeehiCMS CVE-2026-86239

FeehiCMS version 2.1.1 or earlier must be installed with the UEditor backend widget enabled, which is the default configuration. No authentication is required per CVSS PR:N and the exploit's explicit 'Unauthorized' designation. For the upload to yield remote code execution, the web server must serve PHP files from the upload storage directory - a common default in shared hosting and improperly hardened VPS deployments. If the upload directory is configured with PHP execution disabled (e.g., via Nginx fastcgi_pass restriction or Apache php_admin_flag Off), the attacker is limited to uploading arbitrary static files, reducing the impact to file-storage abuse or potential overwrite of existing assets. The exploit is network-accessible from any IP with no special prerequisites beyond HTTP reachability.

The provided CVSS 4.0 score of 6.9 (Medium) with impact metrics VC:L/VI:N/VA:N is notably inconsistent with the vulnerability class. CWE-434 in a PHP application where uploads reach an executable web path typically yields full RCE, implying C:H/I:H/A:H - not VC:L alone. The discrepancy is unexplained: either the upload directory is server-configured to disallow PHP execution (limiting impact to file-storage abuse), or the provided impact metrics are understated. This must be independently verified. The exploitation signal is elevated: CVSS PR:N/AV:N/AC:L confirms unauthenticated, low-complexity, network-accessible exploitation, and a public PoC (FEHI-001) exists. No patch is available and the vendor is unresponsive, leaving no timeline for remediation. Despite the low assigned score, the combination of unauthenticated access, public PoC, and absent patch warrants treating this as higher priority for any FeehiCMS deployment.

An unauthenticated attacker identifies a FeehiCMS instance and sends a crafted HTTP POST request directly to the UEditor upload endpoint, attaching a PHP webshell file. Because UeditorAction::init performs no authentication check and no file-type validation, the file is accepted and stored in the web-accessible upload directory. The attacker then browses to the uploaded file's URL, triggering server-side PHP execution and gaining an interactive command shell as the web server process user. A public PoC (FEHI-001-UEditor-Unauthorized-File-Upload.md on GitHub) documents this exact method.