CVE-2026-95264CWE-22path-traversal

CVE-2026-95264

Medium · published October 6, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to `unlink()` without path traversal or directory validation.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00534 · 44.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-06T00:17Z
References (2)
https://github.com/liufee/cms · [email protected]https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95264.md · [email protected]
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 05 OCT 00:00Z
    Feehi CMS 2.1.1 is vulnerable to Directory Traversal
    cvelistv5