Description

A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-07T02:17:20.890Z",
  "pubdate": "2026-09-07T02:17:20.890Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in FeehiCMS up to version 2.1.1, specifically within the UEditor component's image processing functionality.\nThe flaw stems from insufficient validation of user-supplied input during remote image retrieval, allowing an attacker to coerce the server into initiating unauthorized network requests to arbitrary internal or external destinations.\nThe vulnerability is remotely exploitable and does not explicitly require complex authentication, posing a significant risk to the integrity and confidentiality of internal infrastructure.\nImpact includes the potential for reconnaissance of private internal networks, exploitation of local services hidden behind firewalls, and unauthorized data exfiltration.\nGiven that proof-of-concept exploits are publicly available, the risk to organizations running unpatched versions of FeehiCMS is critical. The maintainers have not yet addressed the report, leaving installations vulnerable to active exploitation.",
  "technicalDetails": "The vulnerability resides in the catchImage function located within backend/widgets/ueditor/Uploader.php. This function is designed to handle the remote fetching of images for the UEditor component when provided with a source URL.\nThe root cause is the lack of robust server-side sanitization and validation on the 'source[]' parameter, which accepts an array of URLs for remote image downloading. The application fails to verify if the requested target is a legitimate image resource or a malicious endpoint, nor does it enforce allow-listing on the destination host, port, or protocol (e.g., HTTP/HTTPS).\nAn attacker can exploit this by injecting arbitrary URLs into the 'source[]' argument. When the Uploader class processes this request, the server-side code performs an outbound HTTP GET request to the attacker-specified URI. Because the server executes the request, it acts as a proxy, bypassing network access controls such as firewalls or NAT that typically isolate internal services from public internet access.\nThe attack flow proceeds as follows: 1. The attacker crafts a request containing the manipulated 'source[]' parameter targeting a local service (e.g., http://127.0.0.1:80/ or an internal database management interface). 2. The Uploader.php script parses the array and passes the unvalidated URL to the underlying network client used by the application. 3. The server performs an outbound request to the target URI. 4. The server processes the response; while the function is intended to handle binary image data, the application's response handling logic may leak information or trigger unintended behavior based on the content returned by the internal target.\nThis SSRF vector allows for blind or semi-blind exploitation, where the attacker can map internal network topologies by observing timing differences or error responses. Furthermore, if the server has access to sensitive internal REST APIs or administrative interfaces that trust the web server's IP address, the attacker can perform unauthorized actions or exfiltrate sensitive configuration data. The vulnerability is critical due to the lack of restrictive network egress policies in most standard web hosting environments, effectively turning the FeehiCMS instance into a pivot point for lateral movement within the host network."
}