Feng Office EUVD-2026-119756

Exploitation requires reaching the Translation Tool component and invoking its write_translations function in application/controllers/ToolController.class.php with a manipulated 'lang' argument. The CVSS vector's PR:H means a high-privilege (administrative) authenticated session on the Feng Office instance is required - this administrative gate is the primary limiting factor and takes this out of reach of anonymous remote attackers. No user interaction is needed (UI:N) and complexity is low (AC:L) once that access is held. Affected versions are Feng Office up to 3.11.13.11 and up to 4.2.1.2; no fixed version is given in the available data and the vendor did not respond, so no vendor mitigation is confirmed.

This is a genuine but constrained issue, not an emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, base 5.1 Medium) shows a network-reachable, low-complexity flaw that nonetheless requires high privileges (PR:H) - meaning an already-authenticated administrative-level user of the Translation Tool, not an anonymous remote attacker. This PR:H gate is the single largest risk-reducer and is consistent with the fact that write_translations is an administrative feature. No EPSS score and no CISA KEV entry are present in the input, and the SSVC-style priority label from the source is 'this_month' (not act_now or emergency), all pointing to low-to-moderate urgency rather than a drop-everything priority. A public PoC reference exists (a GitHub gist) but is marked reference-only and not verified as working exploit code, so exploitation feasibility is suggested but not proven. The vendor was contacted and did not respond, so no authoritative patch or confirmation exists - a meaningful gap. Net: a legitimately interesting code-injection bug (CWE-94) whose real-world risk is capped by the administrative-privilege requirement and the niche footprint of the product; the single disclosing source (VulDB) and unverified PoC warrant independent corroboration.

An attacker who already holds high-privilege access to a Feng Office instance reaches the Translation Tool and submits a crafted value in the 'lang' argument to the write_translations function, which is written into application code and interpreted as PHP (CWE-94). Because the Translation Tool persists translations to code files, the injected payload executes within the application. A public PoC reference (GitHub gist) exists but is not verified as working exploit code, and exploitation is low-complexity (AC:L) once the required privileges are held.