CVE-2025-65657: Feehi FeehiCMS RCE Vulnerability

CVE-2025-65657 Overview

CVE-2025-65657 is a Remote Code Execution (RCE) vulnerability in FeehiCMS version 2.1.1. The flaw resides in the Ad Management component, which permits authenticated remote attackers to upload files without sufficient validation, sanitization, or execution restrictions. An attacker who uploads a crafted PHP file can force the web server to execute it, achieving arbitrary code execution within the application context.

The vulnerability is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command) and requires authentication for exploitation.

Critical Impact
Authenticated attackers can achieve remote code execution on the underlying web server by uploading crafted PHP files through the Ad Management interface, leading to full application compromise.

Affected Products

FeehiCMS version 2.1.1
Feehi CMS Ad Management module
Deployments running the affected release with authenticated user access

Discovery Timeline

2025-12-02 - CVE-2025-65657 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65657

Vulnerability Analysis

The vulnerability exists in the Ad Management feature of FeehiCMS 2.1.1. The upload handler accepts files from authenticated users without enforcing restrictions on file type, extension, or content. Uploaded files are stored in a location that the web server subsequently interprets as executable PHP.

An attacker with valid credentials can submit a PHP file disguised as an advertising asset. Once stored, requesting the file's URL causes the PHP interpreter to execute the attacker-controlled code. This grants the attacker command execution under the privileges of the web server process.

The attack requires network access and low complexity. Confidentiality and integrity impacts are limited to the web application context rather than the underlying host.

Root Cause

The root cause is unrestricted file upload in the Ad Management endpoint. The application fails to validate MIME types, enforce an allowlist of file extensions, or strip executable content before persisting files. The storage directory also lacks execution restrictions at the web server layer.

Attack Vector

Exploitation requires an authenticated session with permissions to access Ad Management. The attacker submits a crafted PHP payload through the ad upload workflow. After the server writes the file to a web-accessible path, the attacker issues an HTTP request to the uploaded resource to trigger execution.

No verified public exploit code is available. Technical details are described in the GitHub CVE-2025-65657 advisory and the upstream CMS issue discussion.

Detection Methods for CVE-2025-65657

Indicators of Compromise

Presence of .php, .phtml, or .phar files in advertising upload directories used by FeehiCMS
Unexpected outbound network connections originating from the web server process shortly after ad upload activity
New administrative or content-editor accounts created without change control records
Web shell signatures or obfuscated PHP code within files served from ad asset paths

Detection Strategies

Monitor HTTP POST requests to Ad Management upload endpoints and correlate with subsequent GET requests to newly created files
Inspect files written to upload directories for PHP tags (<?php, <?=) or eval/base64_decode patterns
Deploy file integrity monitoring on FeehiCMS webroot directories to alert on new executable file creation
Review web server access logs for requests to non-standard file paths under ad storage directories

Monitoring Recommendations

Enable verbose logging on authenticated administrative actions within FeehiCMS
Alert on process execution spawned by the web server user (e.g., www-data, apache, nginx) that invokes shells or system utilities
Track anomalous authentication events targeting FeehiCMS admin accounts, especially from new geographies or IP ranges

How to Mitigate CVE-2025-65657

Immediate Actions Required

Restrict access to the FeehiCMS administrative interface using network controls or a web application firewall (WAF) until a patch is available
Audit all files in ad upload directories and remove any unauthorized PHP or script files
Rotate credentials for all FeehiCMS accounts with Ad Management privileges
Configure the web server to deny PHP execution within upload directories

Patch Information

No vendor patch has been referenced in the enriched CVE data. Administrators should monitor the FeehiCMS upstream repository for remediation updates and apply any released fixes promptly. Until a fix is published, treat FeehiCMS 2.1.1 deployments as vulnerable.

Workarounds

Add a web server rule that blocks execution of PHP files inside ad upload paths, for example using an Apache .htaccess or Nginx location directive
Enforce server-side file type validation via a reverse proxy or WAF policy that inspects uploads for PHP content
Limit Ad Management permissions to a minimal set of trusted administrators
Isolate the FeehiCMS host so that a compromise cannot pivot to internal systems

bash

# Nginx: deny PHP execution inside ad upload directory
location ~* ^/uploads/ads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}

# Apache: place inside upload directory .htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>