CVE-2026-86240: Server-Side Request Forgery in liufee FeehiCMS

CVE-2026-86240 is a server-side request forgery vulnerability in liufee FeehiCMS affecting versions 2.1.0 and 2.1.1. The issue resides in the catchImage function within the UEditor component's Uploader.php file, where improper validation of the source[] parameter allows remote attackers to coerce the server into making arbitrary HTTP requests. This vulnerability was responsibly disclosed but remains unpatched as of the publication date. Exploit code has been publicly released, potentially enabling attackers to leverage this flaw for unauthorized internal network access or information gathering.

Successful exploitation allows remote attackers to make the server perform arbitrary HTTP requests, potentially accessing internal resources or services not directly reachable by the attacker. This can lead to information disclosure or further attacks within the internal network. The vulnerability has a medium severity rating (CVSS 5.1) reflecting limited impact due to required privileges (high privileges needed) and low complexity of attack.

No official fix or patch has been released by the vendor as of the current information. Users should monitor the vendor's communications for updates. Until a patch is available, restrict access to the vulnerable component and consider applying network-level controls to limit outbound requests from the server. Review and restrict permissions to reduce the risk of exploitation.