Is CVE-2026-86239 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86239 being exploited in the wild.

How severe is CVE-2026-86239?

Medium severity, with a CVSS score of 5.3, published 7 September 2026.

Is there a fix for CVE-2026-86239?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86239 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86239?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86239: liufee FeehiCMS arbitrary file upload in UEditor widget

CVE-2026-86239 · Severity: medium · CVSS 5.3 · Published 2026-09-07

FeehiCMS is a content management system that includes a UEditor widget for file uploads. Due to improper authentication controls and disabled CSRF protection, unauthenticated attackers can upload arbitrary files (including executable scripts and configuration files) to the server, potentially leading to remote code execution or data exposure.

Quick answers

Is CVE-2026-86239 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86239 being exploited in the wild.
How severe is CVE-2026-86239?: Medium severity, with a CVSS score of 5.3, published 7 September 2026.
Which products and versions are affected?: liufee FeehiCMS up to 2.1.1.
Is there a fix for CVE-2026-86239?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86239 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86239?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the UeditorAction::init function within the UEditor Widget component. The backend's AccessControl configuration whitelists the entire 'assets/*' action namespace without authentication, exposing multiple file upload endpoints (uploadImage, uploadFile supporting 30+ extensions including .txt, .md, .xml, .zip) and file enumeration actions to unauthenticated attackers. CSRF protection is explicitly disabled in UeditorAction::init, eliminating a secondary defense. An unauthenticated remote attacker can directly upload arbitrary files or enumerate existing files without any authentication requirement or valid session token.

Affected products

liufee FeehiCMS up to 2.1.1

Timeline

2026-07-22: disclosed: Issue reported on GitHub
2026-09-07: advisory: Published in NVD
2026-09-07: other: Public exploit available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.