CVE-2026-95265: Feehi CMS 2.1.1 SSRF Vulnerability

CVE-2026-95265 Overview

CVE-2026-95265 is a Server-Side Request Forgery (SSRF) vulnerability in Feehi CMS 2.1.1. The flaw resides in the UEditor catchimage endpoint, which performs incomplete private-IP validation on user-supplied URLs. The filter does not block loopback (127.0.0.0/8) or link-local (169.254.0.0/16) addresses, allowing unauthenticated attackers to coerce the server into issuing HTTP requests to internal targets. Response differences expose internal service availability, enabling network reconnaissance from the server's perspective. The vulnerability is categorized under CWE-918: Server-Side Request Forgery.

Critical Impact
Remote, unauthenticated attackers can probe internal HTTP services behind the application boundary by abusing the catchimage endpoint to generate server-side requests.

Affected Products

Feehi CMS version 2.1.1
UEditor component integrated with Feehi CMS
Deployments exposing the catchimage endpoint to untrusted clients

Discovery Timeline

2026-10-05 - CVE-2026-95265 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-95265

Vulnerability Analysis

Feehi CMS 2.1.1 bundles the UEditor rich-text editor, which exposes a catchimage endpoint used to fetch remote images referenced in content. The endpoint accepts attacker-controlled URLs and performs a server-side HTTP request to retrieve the resource. The application attempts to filter private-IP destinations before issuing the outbound request.

The validation logic is incomplete. It blocks a subset of RFC 1918 ranges but omits the loopback range (127.0.0.0/8) and the IPv4 link-local range (169.254.0.0/16). An attacker can supply URLs such as those targeting http://127.0.0.1:<port>/ or cloud metadata-adjacent link-local hosts to force the server to make internal requests.

Response differences — status codes, response sizes, and timing — leak the state of internal HTTP services. This gives attackers a reconnaissance primitive against assets normally unreachable from the internet.

Root Cause

The root cause is an incomplete deny-list in the URL validator for the catchimage handler. The filter enumerates private ranges but fails to include loopback and link-local address spaces. A deny-list approach to SSRF filtering is inherently fragile; this implementation exemplifies the common failure mode.

Attack Vector

Exploitation requires only network access to a vulnerable Feehi CMS instance. No authentication or user interaction is required. An attacker submits a crafted URL to the catchimage endpoint pointing at an internal host and port. The server dereferences the URL and returns an error, metadata, or image data depending on what responds at the target. Attackers iterate across ports and paths to map the internal attack surface. See the public CVE submission for technical details and the Feehi CMS repository for the affected code.

Detection Methods for CVE-2026-95265

Indicators of Compromise

Web server access logs showing repeated POST requests to UEditor catchimage endpoints from the same client IP
Outbound HTTP connections from the CMS host targeting 127.0.0.1, 169.254.169.254, or internal RFC 1918 addresses
Requests to catchimage carrying source[] or equivalent parameters with URLs resolving to loopback or link-local hosts
Anomalous application errors in CMS logs tied to failed internal fetch attempts

Detection Strategies

Alert on any server-originated HTTP request to loopback or link-local destinations that is not part of a known health-check pattern
Inspect catchimage request parameters for URLs whose hostnames resolve to private, loopback, or link-local addresses
Correlate high-volume catchimage requests from a single source with outbound connections to varied internal ports, indicating port scanning

Monitoring Recommendations

Capture egress NetFlow or connection telemetry from CMS hosts and baseline normal external destinations
Enable verbose logging of UEditor request parameters including the original URL submitted to catchimage
Forward web and host telemetry into a centralized data lake to enable cross-source correlation and historical review

How to Mitigate CVE-2026-95265

Immediate Actions Required

Restrict access to the UEditor catchimage endpoint to authenticated administrative users only
Place the CMS behind a reverse proxy that filters outbound requests to internal address ranges
Audit CMS logs for prior exploitation attempts targeting loopback or link-local destinations
Remove or disable the UEditor remote-fetch feature if it is not required by the deployment

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Monitor the Feehi CMS GitHub repository for updates and apply fixes once released. Until a patch is available, operators should rely on network-layer and configuration-based mitigations described below.

Workarounds

Replace the catchimage URL validator with an allow-list of trusted external image hosts rather than a deny-list of private ranges
Block egress from the CMS host to 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 via host firewall rules
Resolve submitted hostnames server-side and reject any that map to non-public address space, protecting against DNS rebinding
Disable or remove the UEditor component where remote image ingestion is not a business requirement

bash

# Example iptables egress controls on the CMS host to block SSRF targets
iptables -A OUTPUT -d 127.0.0.0/8    -p tcp --dport 1:65535 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -p tcp --dport 1:65535 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8     -p tcp --dport 1:65535 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12  -p tcp --dport 1:65535 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 1:65535 -j REJECT