PatchSiren cyber security CVE debrief
CVE-2026-86240 liufee CVE debrief
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1, affecting the catchImage function of the UEditor component in the Uploader.php file. This vulnerability results in server-side request forgery, which can be executed remotely. Defenders responsible for FeehiCMS installations, particularly those using UEditor, should assess exposure and review server-side request forgery protections. The project was informed of the problem early through an issue report but has not responded yet. Further verification is required to determine the affected versions and potential impact.
- Vendor
- liufee
- Product
- FeehiCMS
- CVSS
- LOW 2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-09-07
- Original CVE updated
- 2026-09-07
- Advisory published
- 2026-09-07
- Advisory updated
- 2026-09-07
Who should care
Defenders responsible for FeehiCMS installations, particularly those using UEditor, should assess exposure and review server-side request forgery protections. They should also verify the presence of UEditor and review server-side request forgery protections.
Why it matters
Defenders should prioritize verifying the presence of UEditor and reviewing server-side request forgery protections in FeehiCMS installations.
- Verify server-side request forgery protections
- Monitor for potential exploitation attempts
- Review UEditor configuration and usage
Technical summary
The vulnerability affects the catchImage function in the Uploader.php file of the UEditor component in liufee FeehiCMS up to 2.1.1. The manipulation of the source[] argument results in server-side request forgery, which can be executed remotely. Defenders should prioritize verifying the presence of UEditor and reviewing server-side request forgery protections. The CVE record and NVD entry provide limited information about the vulnerability. Defenders should verify the presence of UEditor in FeehiCMS installations, review server-side request forgery protections, and monitor for potential exploitation attempts.
Defensive priority
Defenders should prioritize verifying the presence of UEditor and reviewing server-side request forgery protections.
Recommended defensive actions
- Verify the presence of UEditor in FeehiCMS installations
- Review server-side request forgery protections
- Monitor for potential exploitation attempts
- Review UEditor configuration and usage
- Verify server-side request forgery protections are in place
- Review compensating controls for exposed systems
- Track exceptions and retest remediated assets
Evidence notes
The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. Defenders should verify the presence of UEditor in FeehiCMS installations, review server-side request forgery protections, and monitor for potential exploitation attempts. The manipulation of the source[] argument results in server-side request forgery, which can be executed remotely.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-86240 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-86240
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-86240 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86240
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/liufee/cms/issues/95
-
Source reference
Unverified legacy reference
URL: https://github.com/yang5ynag/cve/blob/main/FEHI-002-UEditor-catchImage-SSRF.md
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/cve/CVE-2026-86240
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/submit/901834
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/vuln/399397
-
Source reference
Unverified legacy reference
URL: https://vuldb.com/vuln/399397/cti
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.