CVE-2026-86239: Unrestricted Upload in liufee FeehiCMS

The vulnerability CVE-2026-86239 affects liufee FeehiCMS up to versions 2.1.0 and 2.1.1. It exists in the UeditorAction::init function within backend/widgets/ueditor/UeditorAction.php of the UEditor Widget component. This flaw allows an attacker to perform unrestricted file uploads remotely, potentially leading to unauthorized file placement on the server. The issue was reported early to the project, but no fix or official response has been provided. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to upload arbitrary files without restriction, which could lead to further compromise depending on the uploaded content. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating a significant risk but not critical. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as restricting upload permissions, disabling the vulnerable component if possible, or applying web application firewall rules to block suspicious upload attempts until an official patch is available.