CVE-2026-95264: n/a

CVE-2026-95264 describes a directory traversal vulnerability in Feehi CMS 2.1.1. An authenticated user with article edit permissions can exploit this flaw to delete arbitrary files on the server that are writable by the PHP process. The vulnerability arises from the use of article image metadata to build a filesystem path that is passed directly to the unlink() function without validating or sanitizing the path to prevent directory traversal attacks.

Successful exploitation allows an authenticated user with article edit permissions to delete arbitrary files on the server that the PHP process can write to. This could lead to denial of service or disruption of application functionality by removing critical files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict article edit permissions to trusted users only and monitor for suspicious activity related to file deletions.