# CVE-2026-95265: Feehi CMS SSRF in UEditor catchimage endpoint

Source: https://junglewise.ai/threats/cve-2026-95265-feehi-cms-2-1-1-contains-a-server-side-request-forgery-ssrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-95265 · Severity: info · Published 2026-10-05

Feehi CMS is a content management system used to manage website content and media. An unauthenticated attacker can exploit an SSRF vulnerability in the image upload feature to probe the server's internal network and services, potentially exposing information about available internal resources through response timing or content differences.

Technologies: [Feehi Cms](https://junglewise.ai/threats/technologies/feehi-cms). Vendors: [Feehi](https://junglewise.ai/threats/vendors/feehi).

## Quick answers

**Is CVE-2026-95265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95265 being exploited in the wild.

**How severe is CVE-2026-95265?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Feehi Cms 2.1.1.

**Is there a fix for CVE-2026-95265?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95265 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-95265?** Check whether you run Feehi Cms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The UEditor catchimage endpoint in Feehi CMS 2.1.1 fails to properly validate URLs, allowing loopback (127.0.0.1) and link-local addresses to bypass the private-IP checks. An unauthenticated attacker can inject URLs in the source parameter to make the server fetch internal HTTP services and infer their availability through response differences. The vulnerability affects backend/web/static/js/plugins/ueditor/php/controller.php and related UEditor components.

## Affected products

- Feehi CMS 2.1.1

## Timeline

- 2026-10-05: disclosed

## References

- [https://github.com/liufee/cms](https://github.com/liufee/cms)
- [https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md](https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md)

## Related threats

- [Feehi CMS directory traversal arbitrary file deletion](https://junglewise.ai/threats/cve-2026-95264-feehi-cms-2-1-1-is-vulnerable-to-directory-traversal-an)
- [Feehi CMS insufficient access control in administrator password change](https://junglewise.ai/threats/cve-2026-95263-feehi-cms-2-1-1-is-vulnerable-to-incorrect-access-control-a-low)
- [Feehi CMS stored XSS in article content module](https://junglewise.ai/threats/cve-2026-31313-feehi-cms-stored-xss-in-article-content-module)
- [Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the Page Sign parameter](https://junglewise.ai/threats/cve-2026-31350-feehi-cms-has-an-authenticated-stored-cross-site-scripting-xss)