CVE-2026-105288: feelec-yishu FeelCRM OS reflected cross-site scripting in CRM endpoint

CVE-2026-105288 · Severity: medium · CVSS 4.3 · Published 2026-10-05

FeelCRM is an open-source customer relationship management system used by small and medium-sized enterprises to manage leads, customers, and contracts. The CRM endpoint contains a reflected cross-site scripting vulnerability in the redirect_url parameter that allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser session. An attacker can use this to steal session data, perform unauthorized actions, or compromise the victim's CRM account through social engineering.

Technologies: Feelec-Yishu Feelcrm-Os. Vendors: Feelec-Yishu.

Quick answers

Is CVE-2026-105288 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105288 being exploited in the wild.
How severe is CVE-2026-105288?
Medium severity, with a CVSS score of 4.3, published 5 October 2026.
Which products and versions are affected?
Feelec-Yishu Feelcrm-Os 1.0.0.
Is there a fix for CVE-2026-105288?
No fixed version is recorded yet. HTML-encode the redirect_url parameter at the template sink using htmlspecialchars with ENT_QUOTES flag. Validate redirect_url against an allowlist of permitted internal routes rather than accepting arbitrary route-like strings. Implement a restrictive Content Security Policy to block inline event handlers as defense in depth.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105288 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-105288?
Check whether you run Feelec-Yishu Feelcrm-Os at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

HTML-encode the redirect_url parameter at the template sink using htmlspecialchars with ENT_QUOTES flag. Validate redirect_url against an allowlist of permitted internal routes rather than accepting arbitrary route-like strings. Implement a restrictive Content Security Policy to block inline event handlers as defense in depth.</anigation> </invoke>

Technical details

The IndexController::index function in App/ThinkPHP/Common/functions.php accepts an attacker-controlled redirect_url parameter and inserts it directly into an iframe src attribute without HTML encoding. The U() URL helper performs route normalization but does not sanitize quotes or other HTML special characters. An authenticated attacker can inject a quote followed by an onload event handler to break out of the src attribute and execute arbitrary JavaScript in the victim's same-origin CRM context.

Affected products

  • feelec-yishu FeelCRM OS 1.0.0

Timeline

  • 2026-09-14: disclosed: Issue report filed on GitHub
  • 2026-10-05: advisory: CVE-2026-105288 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.