CVE-2026-86240 Overview
CVE-2026-86240 is a Server-Side Request Forgery (SSRF) vulnerability affecting liufee FeehiCMS versions up to 2.1.1. The flaw resides in the catchImage function within backend/widgets/ueditor/Uploader.php, part of the UEditor component. Attackers can manipulate the source[] argument to force the server to issue arbitrary HTTP requests to internal or external systems. The vulnerability is exploitable remotely and requires high privileges. A public exploit has been released, and the project maintainer has not responded to the reported issue.
Critical Impact
Authenticated attackers can abuse the catchImage function to perform SSRF, enabling internal network reconnaissance, access to metadata services, or interaction with restricted internal endpoints.
Affected Products
- liufee FeehiCMS versions up to and including 2.1.1
- Component: UEditor (backend/widgets/ueditor/Uploader.php)
- Vulnerable function: catchImage
Discovery Timeline
- 2026-09-07 - CVE-2026-86240 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86240
Vulnerability Analysis
The vulnerability is classified as Server-Side Request Forgery [CWE-918]. It exists in the catchImage handler of the UEditor widget bundled with FeehiCMS. The handler accepts an array of URLs through the source[] request parameter and fetches each resource server-side to store it as a local asset. The implementation does not restrict target hosts, schemes, or IP address ranges before initiating the outbound request.
An authenticated backend user can supply URLs pointing to internal-only services, cloud provider metadata endpoints, or loopback addresses. The server performs the request and may return response content or error information that leaks internal service details. Attack complexity is low, and no user interaction is required beyond providing the crafted parameter.
Root Cause
The root cause is missing input validation and URL allow-listing in the catchImage function. The source[] parameter is passed directly to the URL fetching routine without verifying the destination scheme, host, or resolved IP address. There is no filtering against private address ranges (RFC 1918), link-local addresses, or cloud metadata IPs such as 169.254.169.254.
Attack Vector
Exploitation requires authenticated access to the FeehiCMS backend where the UEditor widget is exposed. An attacker sends an HTTP request to the catchImage endpoint with the source[] parameter set to a URL of their choice. The backend fetches the specified URL and processes the response as an image resource. This allows the attacker to probe internal HTTP services, enumerate open ports, or interact with unauthenticated internal APIs. Detailed exploitation steps are available in the GitHub CVE Technical Document and the VulDB entry.
Detection Methods for CVE-2026-86240
Indicators of Compromise
- Unexpected outbound HTTP requests originating from the FeehiCMS web server to internal IP ranges or cloud metadata endpoints
- Backend access log entries containing catchImage requests with unusual source[] values pointing to non-image URLs
- Web server processes making DNS lookups for internal hostnames or loopback aliases
- Requests to 169.254.169.254, 127.0.0.1, or private RFC 1918 addresses initiated by the PHP-FPM or webserver user
Detection Strategies
- Inspect web server and PHP access logs for POST requests to UEditor endpoints containing action=catchimage with suspicious source[] parameters
- Correlate outbound network telemetry from web server hosts against expected egress destinations
- Deploy web application firewall rules to flag source[] values referencing non-HTTP schemes, internal IPs, or metadata service hosts
Monitoring Recommendations
- Enable egress filtering and log all outbound connections from application servers running FeehiCMS
- Alert on any successful connection from the web tier to cloud provider metadata endpoints
- Monitor authentication logs for the FeehiCMS backend to identify unauthorized privileged accounts that could exploit the flaw
How to Mitigate CVE-2026-86240
Immediate Actions Required
- Restrict backend administrative access to trusted users and networks until a patch is available
- Block egress traffic from FeehiCMS web servers to internal network ranges and cloud metadata endpoints at the network layer
- Disable or remove the UEditor catchImage functionality if it is not required for business operations
- Review backend user accounts and rotate credentials for any privileged users
Patch Information
No vendor patch is available at the time of publication. According to the disclosure, the project was informed through a GitHub issue but has not responded. Organizations should track the upstream repository and apply fixes when released.
Workarounds
- Remove or comment out the catchImage action handler in backend/widgets/ueditor/Uploader.php
- Place the FeehiCMS backend behind a VPN or IP allow-list to prevent unauthenticated exposure
- Implement an outbound proxy that enforces destination allow-lists for any HTTP requests made by the web server
- Configure host firewall rules to deny web server outbound connections to 169.254.0.0/16, 127.0.0.0/8, and RFC 1918 ranges
# Example iptables rules to block SSRF egress from the web server
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
