CVE-2026-105389: Unrestricted Upload in feelec-yishu feelcrm-os

This vulnerability in feelcrm-os 1.0.0 involves improper handling of the 'cmd' argument in the UploadTicketFile endpoint within App/Feelcrm/Crm/Controller/UploadController.class.php, leading to unrestricted file upload capability. The flaw allows remote attackers to upload arbitrary files without restriction, potentially enabling further attacks. The vulnerability was responsibly disclosed to the project, which has not yet issued a fix or response. Public exploit information is available, but no confirmed in-the-wild exploitation has been reported.

Successful exploitation allows remote attackers to upload arbitrary files to the server, which can lead to unauthorized file storage and potentially further compromise depending on the uploaded content. The vulnerability does not require user interaction and has low attack complexity, but requires low privileges. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

As of the current information, no official fix or patch is available from the vendor. Users should monitor the vendor's communications for updates and consider implementing temporary controls such as restricting upload permissions or filtering input parameters to mitigate risk until a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.