Feehi CMS CVE-2026-95265

Exploitation requires reaching the Feehi CMS UEditor 'catchimage' endpoint (the server-side image-fetch feature of the bundled UEditor rich-text editor) and supplying an attacker-controlled URL whose host resolves to a loopback (e.g. 127.0.0.1) or link-local (e.g. 169.254.169.254) address - addresses the product's private-IP validation routine fails to block. Meaningful results also require internal HTTP services whose responses differ observably, since the SSRF is semi-blind (inferred via 'response differences') rather than returning full response bodies. Limiting factors: the supplied vector claims PR:N (unauthenticated), but the description does not confirm that catchimage is reachable without an authenticated/admin session - in many CMS deployments UEditor upload endpoints are gated behind login, which would materially reduce exposure; verify reachability in the specific deployment. Impact is confined to internal service probing/information inference, with no confirmed write or integrity effect.

Signals are mixed and lean toward lower real-world urgency than the 7.5 (HIGH) base score suggests. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which on paper is attractive. However, EPSS is only 0.14% (3rd percentile), indicating a very low modeled probability of exploitation in the near term, and the vulnerability is NOT listed in CISA KEV - there is no evidence of active exploitation. The SSVC framework reports Exploitation: poc (proof-of-concept exists), Automatable: yes, and Technical Impact: partial; the 'partial' technical impact aligns better with a limited/blind SSRF than with the C:H (full confidentiality loss) encoded in the input vector. This is the key tension: the input vector claims C:H, but the description only describes probing internal HTTP services 'through response differences,' which is a semi-blind SSRF yielding limited data exposure - the C:H rating appears inflated, and 'partial' impact plus a loopback/link-local filter bypass is more consistent with C:L. Net assessment: a genuine SSRF worth patching, but given an obscure, low-footprint product, very low EPSS, no KEV listing, and only partial technical impact, this is a high-CVSS-but-moderate-real-risk issue rather than an emergency. Also note PR:N (unauthenticated) is asserted by the input vector but not corroborated by the description - UEditor upload endpoints are frequently gated behind authentication, so verify whether catchimage is reachable pre-auth in the affected deployment.

An attacker sends a crafted request to the Feehi CMS UEditor catchimage endpoint supplying a URL pointing at a loopback (127.0.0.1) or link-local (169.254.0.0/16) address, which the private-IP validation fails to block. By observing differences in the server's responses, the attacker maps and probes internal-only HTTP services (admin panels, metadata endpoints, other internal hosts) that are not directly reachable from outside. A public proof-of-concept exists (SSVC Exploitation: poc), and the low attack complexity makes the technique straightforward to reproduce.