CVE-2026-95264: Feehi CMS Path Traversal Vulnerability

CVE-2026-95264 Overview

CVE-2026-95264 is a directory traversal vulnerability in Feehi CMS 2.1.1 [CWE-22]. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. The flaw stems from article image metadata being used to construct a filesystem path and passed to unlink() without path traversal or directory validation. Successful exploitation allows deletion of files outside the intended image directory, impacting application integrity and availability.

Critical Impact
Authenticated attackers with article edit permission can delete arbitrary files writable by the PHP process, including configuration files, cached data, or application assets that disrupt service operation.

Affected Products

Feehi CMS version 2.1.1
Deployments based on the liufee/cms GitHub repository
Any downstream fork retaining the vulnerable unlink() call path

Discovery Timeline

2026-10-05 - CVE-2026-95264 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-95264

Vulnerability Analysis

The vulnerability resides in the article management workflow of Feehi CMS 2.1.1. When a backend user edits an article, image metadata associated with the article record is read and used to build a filesystem path. The constructed path is then passed directly to the PHP unlink() function to remove the referenced image file.

Because the metadata value is attacker-controlled and the application performs no path normalization, directory containment, or allow-list validation, an authenticated user can supply traversal sequences such as ../ to escape the intended image directory. The deletion operation executes with the privileges of the PHP process, giving the attacker reach into any directory writable by the web server account.

Impact is limited to file deletion, as reflected by the integrity-only impact in the CVSS vector. However, removing files such as .htaccess, PHP configuration includes, session stores, or template caches can produce denial-of-service conditions or weaken security controls that depend on those files.

Root Cause

The root cause is unsanitized use of article image metadata as a filesystem path argument to unlink(). The code path does not canonicalize the resulting path (for example, via realpath()) and does not verify that the final target resides inside the designated upload directory before deletion.

Attack Vector

Exploitation requires network access to the backend interface and valid credentials for an account with article edit permission. The attacker modifies the image metadata field for an article to include directory traversal sequences pointing to a target file. When the deletion routine runs, unlink() is invoked against the traversed path and removes the target file if the PHP process has write permission to it. Refer to the CVE-2026-95264 request documentation for additional context.

Detection Methods for CVE-2026-95264

Indicators of Compromise

Unexpected deletion of files outside the configured upload or image directories under the web root.
Backend article edit or image deletion requests containing path traversal sequences such as ../ or URL-encoded equivalents (%2e%2e%2f).
Application errors referencing missing configuration, template, or cache files following backend activity.
Audit log entries showing article edits from accounts whose normal behavior does not include image management.

Detection Strategies

Inspect web server access logs for POST requests to article edit endpoints containing traversal patterns in image metadata parameters.
Enable PHP open_basedir violation logging to surface unlink() calls targeting paths outside permitted directories.
File integrity monitoring on application configuration files, .htaccess, and critical PHP includes to flag unauthorized deletions.
Correlate authenticated session activity with filesystem change events on the web server.

Monitoring Recommendations

Alert on any unlink() or file deletion event in the Feehi CMS upload path that targets a parent directory.
Monitor backend authentication events to detect compromised or newly created editor accounts.
Review article revision history for suspicious changes to image metadata fields.

How to Mitigate CVE-2026-95264

Immediate Actions Required

Restrict backend article edit permissions to trusted users and audit existing accounts that hold this role.
Enforce strong, unique credentials and multi-factor authentication on all backend accounts.
Apply open_basedir and least-privilege filesystem permissions so the PHP process cannot write outside the application directory.
Back up configuration files and application assets so deletions can be reversed.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-95264 at the time of publication. Monitor the liufee/cms GitHub repository for upstream fixes and apply updates as they become available.

Workarounds

Validate and canonicalize all image metadata paths server-side using realpath() and reject paths that resolve outside the designated upload directory.
Replace direct unlink() calls with a helper that enforces an allow-listed base directory.
Temporarily revoke article edit permissions from non-essential accounts until a fix is applied.
Deploy a web application firewall rule to block traversal sequences in backend article edit parameters.

bash

# Example PHP open_basedir restriction in php.ini or vhost config
php_admin_value open_basedir "/var/www/feehicms/:/tmp/"