CVE-2026-86239: FeehiCMS Unrestricted Upload RCE Vulnerability

CVE-2026-86239 Overview

CVE-2026-86239 is an unrestricted file upload vulnerability in liufee FeehiCMS versions up to 2.1.1. The flaw resides in the UeditorAction::init function within backend/widgets/ueditor/UeditorAction.php, part of the UEditor Widget component. Remote attackers can abuse improper access control [CWE-284] to upload arbitrary files without authentication. Public exploit details are available, and the project maintainer has not responded to the disclosure filed via a GitHub issue report.

Critical Impact
Remote unauthenticated attackers can upload arbitrary files to affected FeehiCMS deployments, potentially enabling webshell deployment and further server compromise.

Affected Products

liufee FeehiCMS versions up to and including 2.1.1
Component: UEditor Widget (backend/widgets/ueditor/UeditorAction.php)
Affected function: UeditorAction::init

Discovery Timeline

2026-09-07 - CVE-2026-86239 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86239

Vulnerability Analysis

The vulnerability originates in the UeditorAction::init method of the FeehiCMS UEditor Widget. UEditor is a rich-text editor commonly integrated into content management systems that exposes an upload endpoint for images, files, and other media. In FeehiCMS, this endpoint does not enforce sufficient access controls or validate the type of uploaded content. Remote attackers can reach the endpoint over the network without authentication and deliver arbitrary files, including server-side script files. Successful exploitation can lead to persistent webshells on the backend server, which may be reached from a browser after upload and used for command execution.

Root Cause

The root cause is improper access control [CWE-284] combined with a lack of file-type restriction in the upload handler. The init method accepts upload requests and processes them without verifying that the caller is authenticated, authorized, or that the submitted content matches an allowed extension and MIME type. Because UEditor writes uploaded files under the web root using attacker-influenced filenames, dangerous file types can be persisted and later executed by the PHP interpreter.

Attack Vector

Exploitation requires only network access to the FeehiCMS backend upload endpoint exposed by the UEditor Widget. No authentication, user interaction, or elevated privileges are needed. An attacker crafts a multipart HTTP request targeting the UEditor action responsible for file uploads and delivers a payload with a PHP extension or other server-executable file type. Once written to disk, the attacker requests the file directly to trigger execution. Refer to the GitHub CVE Documentation and VulDB CVE Details for full technical details.

Detection Methods for CVE-2026-86239

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) inside UEditor upload directories under the FeehiCMS web root.
HTTP POST requests to UEditor endpoints containing action=uploadfile, action=uploadimage, or action=uploadscrawl parameters from unauthenticated sessions.
Newly written files with randomized names in backend/widgets/ueditor/ upload paths, followed by direct GET requests to those files.

Detection Strategies

Monitor web server access logs for anonymous requests to UeditorAction endpoints, particularly upload actions originating from external IP ranges.
Deploy web application firewall rules that inspect multipart uploads to UEditor paths and block requests carrying disallowed extensions or PHP magic bytes.
Perform file integrity monitoring on directories writable by the web server to identify new script files created outside deployment windows.

Monitoring Recommendations

Alert on process creation where the PHP-FPM or web server user spawns shell interpreters such as /bin/sh, bash, or cmd.exe.
Track outbound connections initiated by the web server process to unfamiliar destinations following file uploads.
Review authentication and session logs for administrative activity that lacks a preceding successful login event.

How to Mitigate CVE-2026-86239

Immediate Actions Required

Restrict network access to the FeehiCMS backend interface using firewall rules, VPN, or IP allowlisting until a fix is available.
Remove or disable the UEditor Widget upload endpoints if the rich-text editor is not required for site operations.
Audit UEditor upload directories for unauthorized files and remove any suspicious scripts discovered during triage.

Patch Information

As of the disclosure, the FeehiCMS project has not published a patch. The maintainer was notified through the GitHub Issue Discussion but has not responded. Track the upstream repository for future releases addressing the UEditor upload handler.

Workarounds

Configure the web server to deny execution of PHP and other script files within UEditor upload directories using directives such as Apache php_admin_flag engine off or Nginx location blocks that return 403 for script extensions.
Place the FeehiCMS backend behind an authenticating reverse proxy so that unauthenticated requests cannot reach the vulnerable endpoint.
Apply a web application firewall signature that blocks POST requests to UEditor upload actions containing disallowed file extensions or PHP tags.

bash

# Nginx workaround: deny script execution in UEditor upload paths
location ~* ^/backend/widgets/ueditor/.*\.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$ {
    deny all;
    return 403;
}