Executive brief
Feng Office, a project management and collaboration platform, contains a security flaw that allows unauthorized users to upload files to the server. An attacker can use this to place malicious scripts on the system, potentially leading to the theft of administrator login sessions or full control over the application. This could result in the exposure of sensitive project data, client information, and internal communications.
Technical details
An unauthenticated arbitrary file upload vulnerability exists in ck_upload_handler.php within Feng Office Community Edition 3.11.13.11. The vulnerability stems from two primary failures: the script lacks authentication middleware (CWE-306), and the server-side file extension validation logic (intended to restrict uploads to images) is explicitly commented out in the source code (CWE-434). A remote, unauthenticated attacker can send a multipart POST request to this endpoint to upload arbitrary files, such as .php or .html scripts, to the web-accessible /tmp/ directory. When combined with the application's failure to use HttpOnly flags for session cookies, an attacker can use uploaded HTML files to perform Stored Cross-Site Scripting (XSS) to hijack administrative sessions. As of the advisory date, the vulnerability remains unpatched.
Affected products
- Feng Office Feng Office Community Edition 3.11.13.11
Timeline
- 2026-07-17: disclosed: Public disclosure of CVE-2026-36669 and PoC repository.
- 2026-07-17: advisory: NVD publication date.