CVE-2026-86239 liufee CVE debrief

Who should care

Defenders responsible for liufee FeehiCMS installations, security teams, and vulnerability management teams should assess exposure and prioritize verification and remediation planning. Operators and administrators of affected systems need to review and act on this vulnerability. Security teams should track exceptions and retest remediated assets. Platform and vulnerability management teams should review compensating controls and monitoring for exposed or 3

Why it matters

CVE-2026-86239 is a medium-severity vulnerability in liufee FeehiCMS that allows unrestricted file upload, with a publicly available exploit. Defenders should prioritize verification, exposure assessment, and remediation planning.

• Potential for malicious file uploads
• Possible exploitation via publicly available exploits
• Need for verification of vulnerability and exposure
• Priority for vendor remediation plans

Technical summary

The vulnerability is located in the UeditorAction::init function of the UEditor Widget in liufee FeehiCMS up to 2.1.1, allowing unrestricted file upload. The CVSS score is 5.5, and the severity is medium. The exploit is publicly available, increasing the risk of exploitation. Defenders should prioritize verifying vulnerability and assessing exposure in their environments. No additional technical details are provided beyond CVE and NVD information. Affected product context suggests potential for malicious file uploads.

Defensive priority

Defenders should prioritize verifying the vulnerability and assessing exposure, as the exploit is publicly available.

Recommended defensive actions

• Verify the vulnerability and assess exposure
• Check for publicly available exploits
• Consider compensating controls or monitoring
• Review vendor remediation plans
• Perform asset inventory of potentially affected systems
• Review change management windows for patch deployment
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The vendor has not responded to the issue report. Defenders should verify the vulnerability and assess exposure due to the publicly available exploit. Evidence is limited to CVE and NVD information, with no additional source details provided. Verify affected product deployments exist in managed environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.