CVE-2026-86240CWE-918ssrf

CVE-2026-86240

Medium · published September 7, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00396 · 32.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-07T06:17Z
References (6)
https://github.com/liufee/cms/issues/95 · [email protected]https://github.com/yang5ynag/cve/blob/main/FEHI-002-UEditor-catchImage-SSRF.md · [email protected]https://vuldb.com/cve/CVE-2026-86240 · [email protected]https://vuldb.com/submit/901834 · [email protected]https://vuldb.com/vuln/399397 · [email protected]https://vuldb.com/vuln/399397/cti · [email protected]
EPSS history
Timeline
  • 08 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 07 SEP 01:00Z
    liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery
    cvelistv5