CVE-2026-105290 feelec-yishu CVE debrief

Who should care

Defenders responsible for feelec-yishu feelcrm-os 1.0.0 deployments should assess exposure and potential for server-side request forgery attacks. They should verify the getCurlData endpoint exposure and evaluate potential impacts on affected systems. Defenders should also prioritize verifying exposure and assessing potential impacts due to public disclosure of the exploit.

Why it matters

Defenders should prioritize verifying exposure of the getCurlData endpoint in feelec-yishu feelcrm-os 1.0.0 and assessing the potential for server-side request forgery attacks due to public disclosure of the exploit.

• Potential for server-side request forgery attacks
• Public disclosure of exploit may increase attack attempts
• Limited information on actual exploitation or impact

Technical summary

The vulnerability affects the getCurlData endpoint in feelec-yishu feelcrm-os 1.0.0, allowing for server-side request forgery attacks. The exploit has been publicly disclosed. The project was informed of the problem early through an issue report but has not responded yet. Affected product deployments should be verified for exposure and potential impact assessed by defenders responsible for these systems. The vulnerability allows for server-side request forgery attacks due to manipulation of the url argument in the getCurlData endpoint.

Defensive priority

Defenders should prioritize verifying exposure of the getCurlData endpoint in feelec-yishu feelcrm-os 1.0.0 and assessing the potential for server-side request forgery attacks.

Recommended defensive actions

• Verify exposure of the getCurlData endpoint in feelec-yishu feelcrm-os 1.0.0
• Assess the potential for server-side request forgery attacks
• Monitor for publicly disclosed exploits
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The exploit has been publicly disclosed, but there is no information on actual exploitation or impact. Defenders should verify the getCurlData endpoint in feelec-yishu feelcrm-os 1.0.0 for exposure and assess potential server-side request forgery attacks. Evidence is limited to CVE and NVD entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.