Is CVE-2026-86240 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86240 being exploited in the wild.

How severe is CVE-2026-86240?

Medium severity, with a CVSS score of 4.7, published 7 September 2026.

Is there a fix for CVE-2026-86240?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86240 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86240?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86240: liufee FeehiCMS server-side request forgery in UEditor

CVE-2026-86240 · Severity: medium · CVSS 4.7 · Published 2026-09-07

FeehiCMS is a content management system with an integrated image editor component (UEditor). An unauthenticated attacker can exploit a flaw in the image fetch function to make the server send HTTP requests to internal network addresses (including localhost services) that would normally be inaccessible from outside the network. This could allow attackers to scan internal services, access cloud metadata endpoints, or compromise backend systems.

Quick answers

Is CVE-2026-86240 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86240 being exploited in the wild.
How severe is CVE-2026-86240?: Medium severity, with a CVSS score of 4.7, published 7 September 2026.
Which products and versions are affected?: liufee FeehiCMS up to 2.1.1.
Is there a fix for CVE-2026-86240?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86240 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86240?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the catchImage function within backend/widgets/ueditor/Uploader.php. The root cause is insufficient IP address validation in the saveRemote() function (line 235), which uses PHP's FILTER_FLAG_NO_PRIV_RANGE filter that only blocks private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but fails to block loopback (127.0.0.0/8) and link-local (169.254.0.0/16) addresses. The attack is network-reachable and requires no authentication; the attacker can manipulate the source[] parameter to trigger arbitrary HTTP requests. Combined with the assets/* whitelist, this enables internal port scanning, access to internal services, and potential cloud metadata endpoint access. No patch has been released as of the disclosure date.

Affected products

liufee FeehiCMS up to 2.1.1

Timeline

2026-07-22: disclosed: Issue reported on GitHub
2026-09-07: advisory: CVE-2026-86240 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.