Description

A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T02:17:20.710Z",
  "pubdate": "2026-09-07T02:17:20.710Z",
  "executiveSummary": "A critical unrestricted file upload vulnerability exists in FeehiCMS versions up to 2.1.1, specifically within the UEditor Widget component. The vulnerability arises from insufficient validation of user-supplied files processed by the UeditorAction::init function. An attacker can leverage this flaw to upload arbitrary files, including malicious web shells, directly to the server, potentially leading to remote code execution (RCE).\nThe vulnerability is remotely exploitable, allowing unauthenticated or low-privileged actors to bypass security controls by manipulating the file upload process. Given that a public exploit is available, the risk to affected deployments is high. Successful exploitation grants the attacker the ability to execute arbitrary commands, access sensitive system data, or compromise the integrity of the underlying infrastructure. The vulnerability remains unpatched by the vendor, necessitating immediate administrative intervention to mitigate exposure.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of the file upload mechanism within the UEditor Widget component of FeehiCMS. Specifically, the backend/widgets/ueditor/UeditorAction.php file fails to enforce rigorous server-side validation or sanitization on uploaded content via the UeditorAction::init function. This allows an attacker to bypass intended file type restrictions, MIME-type checks, or path validation mechanisms that are typically expected for secure file handling.\nExploitation is achieved by targeting the vulnerable initialization routine of the UEditor action. An attacker can craft a malicious HTTP request that mimics the expected upload structure of the UEditor library. By manipulating request parameters or bypassing the client-side filters, the attacker forces the application to write an arbitrary file—such as a PHP web shell—to an accessible directory on the server's filesystem.\nThe attack flow follows these steps: first, the attacker identifies the endpoint associated with UeditorAction. Second, the attacker interacts with the file upload functionality, providing a crafted payload disguised as a legitimate document or image. Third, due to the lack of adequate verification in backend/widgets/ueditor/UeditorAction.php, the server process fails to identify the file's true nature and proceeds to save the malicious file to a publicly reachable directory within the web root. Finally, the attacker performs a secondary request to the uploaded file's path, triggering the web server to execute the embedded code.\nThe vulnerability affects versions up to 2.1.1 and is exposed over the network. As the logic resides within the server-side processing of the UEditor request, it does not inherently require high-level administrative credentials depending on the specific configuration and path accessibility of the widget endpoint. The post-exploitation impact is severe, as the ability to execute arbitrary PHP code allows the attacker to gain full control over the application environment, perform lateral movement within the hosting network, exfiltrate database contents, or modify site configurations."
}