Feehi CMS CVE-2026-95264

Requires an authenticated backend session for a user granted article-edit permission; exploitation is performed by supplying a crafted path in an article's image metadata, which is concatenated into a filesystem path and passed to unlink() with no traversal or directory validation (CWE-22). Limiting factors: the account must exist and hold edit rights (PR:L, not anonymous), only files writable by the PHP/web-server process can be deleted, and there is no confidentiality or code-execution impact - the primitive is file deletion only. No special non-default feature toggle is named in the description beyond having article-edit access to the CMS backend.

This is a moderate, not urgent, priority. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable, low-complexity flaw but one that explicitly requires prior authentication (PR:L) as a backend user holding article-edit permission - so it is not an anonymous internet-facing bug. All quantitative exploitation signals point low: EPSS is 0.24% (14th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified among the references (the tao0845 link is a CVE request/write-up, not weaponized POC). No SSVC decision data was provided in the input. The impact is scoped to arbitrary file deletion of files writable by the PHP process, which CVSS encodes as I:H with C:N/A:N - note this is a modeling choice: unauthenticated-to-attacker it is integrity, but arbitrary deletion of web-writable files (e.g., config or content) realistically degrades availability too, which the vector does not credit. Net: a genuine authenticated post-exploitation/privilege-abuse issue in a niche CMS, not a mass-exploitation threat.

An attacker who already holds a low-privileged backend account with article-edit rights edits an article's image metadata, embedding a path-traversal sequence (e.g., ../../) so the value is concatenated into a filesystem path and passed to unlink(). On save, the application deletes an arbitrary file writable by the PHP process, such as a configuration file or another user's uploaded content. No public exploit code was identified at time of analysis; exploitation requires valid authenticated access.