CVE-2026-105288 feelec-yishu CVE debrief

Who should care

Defenders responsible for the security of feelec-yishu feelcrm-os 1.0.0 deployments should assess their exposure to this XSS vulnerability and prioritize verification and mitigation efforts.

Why it matters

CVE-2026-105288 is a cross-site scripting vulnerability in feelec-yishu feelcrm-os 1.0.0 that requires verification and potential mitigation efforts from defenders.

• Defenders need to verify the presence of this vulnerability in their inventory and assess the exposure of their systems.
• Successful exploitation could lead to unauthorized script execution in the context of affected user sessions.
• Defenders should consider implementing compensating controls to mitigate the risk of exploitation.
• Remediation priority is currently unknown due to limited information from the vendor.

Technical summary

The vulnerability is located in the IndexController::index function of the App/ThinkPHP/Common/functions.php file in feelec-yishu feelcrm-os 1.0.0. The function does not properly handle the redirect_url argument, allowing for cross-site scripting (XSS) attacks. The attack can be performed remotely, and the exploit has been publicly disclosed. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the exposure of their systems to this XSS vulnerability. The project was informed of the problem early through an issue report but has not responded yet.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the exposure of their systems to this XSS vulnerability.

Recommended defensive actions

• Verify the presence of this vulnerability in your inventory
• Assess the exposure of your systems to this XSS vulnerability
• Consider implementing compensating controls to mitigate the risk
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide information about the vulnerability, but the vendor has not provided any updates or patches. The exploit has been publicly disclosed, but there is no information on its usage in attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.