CVE-2026-36669: Feng Office File Upload Vulnerability

CVE-2026-36669 Overview

CVE-2026-36669 is an unauthenticated arbitrary file upload vulnerability in Feng Office 3.11.13.11. The flaw resides in the ck_upload_handler.php script, which fails to authenticate requests or validate uploaded file types. Remote attackers can upload malicious files, including .html payloads, to the web-accessible /tmp/ directory. The vulnerability maps to CWE-434: Unrestricted Upload of File with Dangerous Type and enables client-side attacks, phishing content hosting, and potential code execution paths depending on server configuration.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files to a web-accessible directory, enabling malware hosting, phishing, and cross-site scripting against authenticated Feng Office users.

Affected Products

Feng Office 3.11.13.11
ck_upload_handler.php upload endpoint
Deployments exposing the /tmp/ directory over HTTP

Discovery Timeline

2026-07-17 - CVE-2026-36669 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-36669

Vulnerability Analysis

The vulnerability exists in the ck_upload_handler.php script used by Feng Office 3.11.13.11 for file uploads originating from the CKEditor integration. The handler accepts multipart HTTP POST requests without verifying that the caller holds an authenticated session. It also fails to enforce a server-side allowlist for file extensions or MIME types. As a result, an unauthenticated remote attacker can submit arbitrary content and have it written to the /tmp/ directory on the web server. Because /tmp/ is web-accessible in the default deployment, the uploaded content can be retrieved directly through a browser.

The combination of missing authentication and missing content validation escalates a simple upload feature into a network-exploitable primitive. Attackers can host malicious HTML for phishing, deliver JavaScript that targets authenticated Feng Office sessions, or stage secondary payloads for further exploitation.

Root Cause

The root cause is twofold: absence of authentication checks on the ck_upload_handler.php endpoint and absence of extension or MIME validation before persisting the uploaded file. The handler treats any incoming request as trusted and writes the payload to a directory served by the web tier.

Attack Vector

Exploitation requires only network access to the Feng Office web interface. An attacker issues a crafted multipart POST request to ck_upload_handler.php containing a file with an attacker-controlled extension. The server writes the file to /tmp/, and the attacker requests the resulting URL to trigger execution or delivery in the victim's browser. No user interaction, credentials, or elevated privileges are required. A proof-of-concept is available in the public GitHub repository for CVE-2026-36669.

No verified exploitation code is reproduced here. See the linked PoC repository for technical details on the request format and payload delivery.

Detection Methods for CVE-2026-36669

Indicators of Compromise

Unexpected files, particularly .html, .js, .svg, or .phtml, present in the Feng Office /tmp/ directory
HTTP POST requests to ck_upload_handler.php originating from unauthenticated sessions or unfamiliar IP addresses
Outbound requests from user browsers to /tmp/-hosted URLs following phishing lures

Detection Strategies

Inspect web server access logs for POST requests to ck_upload_handler.php that lack a valid authenticated session cookie
Alert on any GET requests targeting files under /tmp/ with executable or renderable extensions
Integrity-monitor the /tmp/ directory and flag files created outside expected application workflows

Monitoring Recommendations

Forward Feng Office web server and application logs to a centralized logging platform for correlation and retention
Deploy a web application firewall (WAF) rule that blocks unauthenticated uploads to the CKEditor handler
Baseline normal upload behavior by user and source IP, then alert on statistical outliers

How to Mitigate CVE-2026-36669

Immediate Actions Required

Restrict access to ck_upload_handler.php at the reverse proxy or web server layer until a patched build is deployed
Block direct HTTP access to the /tmp/ directory to prevent retrieval of attacker-uploaded content
Audit the /tmp/ directory for unexpected files and remove any that cannot be attributed to legitimate application activity

Patch Information

No vendor advisory or patched release is referenced in the NVD entry at the time of publication. Monitor the Feng Office official website for security updates addressing CVE-2026-36669 and apply fixes as soon as they are released.

Workarounds

Add a server-side authentication check in front of ck_upload_handler.php using a web server directive or reverse proxy rule
Configure the web server to deny execution and direct retrieval of content under /tmp/
Enforce an allowlist of permitted MIME types and extensions at the WAF or proxy layer
Isolate the Feng Office instance behind a VPN or IP allowlist while a permanent fix is pending

bash

# Example nginx configuration to block direct access to /tmp/ and the vulnerable handler
location ^~ /tmp/ {
    deny all;
    return 403;
}

location = /public/assets/javascript/ckeditor/plugins/fg_file_browser/ck_upload_handler.php {
    allow 10.0.0.0/8;
    deny all;
}