Executive brief
Feehi CMS, a content management system, contains a security flaw in its article creation and editing module. An authenticated user can inject malicious scripts into the content field of an article. If another user or an administrator views the affected article, the script could execute in their browser, potentially allowing the attacker to steal session cookies or perform actions on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Feehi CMS v2.1.1 due to insufficient input sanitization and output encoding in the article creation and editing module. An authenticated attacker with permissions to create or edit content can inject malicious JavaScript into the 'Content' field. This payload is stored in the database and executed in the context of any user (including administrators) who subsequently views the compromised article. The attack requires network access and low-level authentication, but relies on a victim interacting with the malicious content. Mitigation involves implementing robust input filtering and output encoding, or utilizing a whitelist for permitted HTML tags.
Affected products
- Feehi Feehi CMS 2.1.1
Timeline
- 2026-02-06: disclosed: Vulnerability reported on GitHub issues
- 2026-04-06: advisory: NVD published the CVE record