PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-86240 liufee CVE debrief

A security flaw has been discovered in liufee FeehiCMS up to 2.1.1, affecting the catchImage function of the UEditor component in the Uploader.php file. This vulnerability results in server-side request forgery, which can be executed remotely. Defenders responsible for FeehiCMS installations, particularly those using UEditor, should assess exposure and review server-side request forgery protections. The project was informed of the problem early through an issue report but has not responded yet. Further verification is required to determine the affected versions and potential impact.

Vendor
liufee
Product
FeehiCMS
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-07
Original CVE updated
2026-09-07
Advisory published
2026-09-07
Advisory updated
2026-09-07

Who should care

Defenders responsible for FeehiCMS installations, particularly those using UEditor, should assess exposure and review server-side request forgery protections. They should also verify the presence of UEditor and review server-side request forgery protections.

Why it matters

Defenders should prioritize verifying the presence of UEditor and reviewing server-side request forgery protections in FeehiCMS installations.

  • Verify server-side request forgery protections
  • Monitor for potential exploitation attempts
  • Review UEditor configuration and usage

Technical summary

The vulnerability affects the catchImage function in the Uploader.php file of the UEditor component in liufee FeehiCMS up to 2.1.1. The manipulation of the source[] argument results in server-side request forgery, which can be executed remotely. Defenders should prioritize verifying the presence of UEditor and reviewing server-side request forgery protections. The CVE record and NVD entry provide limited information about the vulnerability. Defenders should verify the presence of UEditor in FeehiCMS installations, review server-side request forgery protections, and monitor for potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying the presence of UEditor and reviewing server-side request forgery protections.

Recommended defensive actions

  • Verify the presence of UEditor in FeehiCMS installations
  • Review server-side request forgery protections
  • Monitor for potential exploitation attempts
  • Review UEditor configuration and usage
  • Verify server-side request forgery protections are in place
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. Defenders should verify the presence of UEditor in FeehiCMS installations, review server-side request forgery protections, and monitor for potential exploitation attempts. The manipulation of the source[] argument results in server-side request forgery, which can be executed remotely.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-86240 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-86240

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-86240 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86240

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.