Executive brief
FeehiCMS is a content management system with an integrated image editor component (UEditor). An unauthenticated attacker can exploit a flaw in the image fetch function to make the server send HTTP requests to internal network addresses (including localhost services) that would normally be inaccessible from outside the network. This could allow attackers to scan internal services, access cloud metadata endpoints, or compromise backend systems.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the catchImage function within backend/widgets/ueditor/Uploader.php. The root cause is insufficient IP address validation in the saveRemote() function (line 235), which uses PHP's FILTER_FLAG_NO_PRIV_RANGE filter that only blocks private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but fails to block loopback (127.0.0.0/8) and link-local (169.254.0.0/16) addresses. The attack is network-reachable and requires no authentication; the attacker can manipulate the source[] parameter to trigger arbitrary HTTP requests. Combined with the assets/* whitelist, this enables internal port scanning, access to internal services, and potential cloud metadata endpoint access. No patch has been released as of the disclosure date.
Affected products
- liufee FeehiCMS up to 2.1.1
Timeline
- 2026-07-22: disclosed: Issue reported on GitHub
- 2026-09-07: advisory: CVE-2026-86240 published