Feng Office EUVD-2026-119755

Requires a valid low-privileged authenticated session on the Feng Office instance (CVSS PR:L) and the ability to reach the File Handler feature's upload_document_image function in application/controllers/FilesController.class.php. The attacker controls the 'url' argument, which the server fetches, producing server-side request forgery; no user interaction (UI:N) and no special attack requirement (AT:N) are needed beyond authentication. LIMITING FACTORS: exploitation is gated by needing credentials (not anonymous), the real-world impact depends on what internal services/metadata endpoints are reachable from the server, and affected versions are those up to 3.11.13.11 and 4.2.1.2 - no vendor-confirmed fixed version is available since the vendor did not respond.

This is a moderate-severity, authenticated SSRF (CWE-918) in Feng Office, and the signals align toward a real-but-not-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates remote, low-complexity exploitation but requires PR:L - the attacker needs valid low-privileged credentials, which materially limits blast radius. Impact is rated low across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no scope change (SC:N), consistent with an SSRF that lets an authenticated user coerce server-side requests rather than directly compromising the host. The vuln.today decision label is 'this_month' (not act_now/emergency), there is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of active or widespread exploitation. A public PoC reference exists (a GitHub gist marked 'exploit') but it is not verified as working exploit code, and the exploitation status per input is E:P (Proof-of-Concept) - this is distinct from confirmed in-the-wild use. Net: prioritize as routine patching within the normal cycle, not as an emergency. Caveats to verify: the input provides only a CVSS 4.0 vector (no 3.1), EPSS and KEV are absent (absence is not confirmation of low risk, just missing data), and the vendor did not respond to disclosure, so no authoritative advisory or fixed version exists.

An authenticated low-privileged Feng Office user invokes the file-handler's document-image upload and supplies an attacker-controlled value in the 'url' argument, causing the server to issue a request to an internal or attacker-chosen endpoint (e.g., cloud metadata services or internal hosts behind the firewall). A public PoC reference (GitHub gist) exists but is not verified as working exploit code. Exploitation is remote and low-complexity but gated by the need for a valid low-privilege account (PR:L).