{"id":"CVE-2026-86239","title":"A vulnerability was identified in liufee FeehiCMS up to 2.1.1","summary":"A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unre…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-284","CWE-434"],"vendor":"liufee","product":"FeehiCMS","affected":["FeehiCMS 2.1.0","FeehiCMS 2.1.1"],"published":"2026-09-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T15:17:15.157","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86239","references":[{"url":"https://github.com/liufee/cms/issues/94","label":"cna@vuldb.com"},{"url":"https://github.com/yang5ynag/cve/blob/main/FEHI-001-UEditor-Unauthorized-File-Upload.md","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-86239","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/901833","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399396","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399396/cti","label":"cna@vuldb.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-09T14:10:09.775218Z"},"epss":0.00509,"epssPercentile":0.42314,"ingestedAt":"2026-09-07T12:10:16.508Z","slug":"CVE-2026-86239","body":"## Overview\n\nA vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202100,"id":"CVE-2026-86239","ts":1789400062578,"field":"exploit_available","old":"false","new":"true"},{"seq":200827,"id":"CVE-2026-86239","ts":1789397616571,"field":"exploit_available","old":"true","new":"false"},{"seq":199520,"id":"CVE-2026-86239","ts":1789395529103,"field":"exploit_available","old":"false","new":"true"},{"seq":198765,"id":"CVE-2026-86239","ts":1789392244300,"field":"exploit_available","old":"true","new":"false"},{"seq":197098,"id":"CVE-2026-86239","ts":1789384292579,"field":"exploit_available","old":"false","new":"true"},{"seq":194227,"id":"CVE-2026-86239","ts":1789378783229,"field":"exploit_available","old":"true","new":"false"},{"seq":193014,"id":"CVE-2026-86239","ts":1789376515270,"field":"exploit_available","old":"false","new":"true"},{"seq":191801,"id":"CVE-2026-86239","ts":1789373631260,"field":"exploit_available","old":"true","new":"false"},{"seq":190586,"id":"CVE-2026-86239","ts":1789369475890,"field":"exploit_available","old":"false","new":"true"},{"seq":189373,"id":"CVE-2026-86239","ts":1789368417412,"field":"exploit_available","old":"true","new":"false"},{"seq":188156,"id":"CVE-2026-86239","ts":1789365230957,"field":"exploit_available","old":"false","new":"true"},{"seq":186943,"id":"CVE-2026-86239","ts":1789363471426,"field":"exploit_available","old":"true","new":"false"},{"seq":185729,"id":"CVE-2026-86239","ts":1789361229315,"field":"exploit_available","old":"false","new":"true"},{"seq":184516,"id":"CVE-2026-86239","ts":1789358363913,"field":"exploit_available","old":"true","new":"false"},{"seq":182767,"id":"CVE-2026-86239","ts":1789354317365,"field":"exploit_available","old":"false","new":"true"},{"seq":181560,"id":"CVE-2026-86239","ts":1789353317853,"field":"exploit_available","old":"true","new":"false"},{"seq":180353,"id":"CVE-2026-86239","ts":1789350284895,"field":"exploit_available","old":"false","new":"true"},{"seq":179146,"id":"CVE-2026-86239","ts":1789348293079,"field":"exploit_available","old":"true","new":"false"},{"seq":177939,"id":"CVE-2026-86239","ts":1789346370205,"field":"exploit_available","old":"false","new":"true"},{"seq":176732,"id":"CVE-2026-86239","ts":1789343184673,"field":"exploit_available","old":"true","new":"false"},{"seq":174849,"id":"CVE-2026-86239","ts":1789334875881,"field":"exploit_available","old":"false","new":"true"},{"seq":173644,"id":"CVE-2026-86239","ts":1789333691736,"field":"exploit_available","old":"true","new":"false"},{"seq":172458,"id":"CVE-2026-86239","ts":1789331093218,"field":"exploit_available","old":"false","new":"true"},{"seq":171272,"id":"CVE-2026-86239","ts":1789328781040,"field":"exploit_available","old":"true","new":"false"},{"seq":170067,"id":"CVE-2026-86239","ts":1789327197350,"field":"exploit_available","old":"false","new":"true"},{"seq":168862,"id":"CVE-2026-86239","ts":1789323840265,"field":"exploit_available","old":"true","new":"false"},{"seq":167657,"id":"CVE-2026-86239","ts":1789319702791,"field":"exploit_available","old":"false","new":"true"},{"seq":166452,"id":"CVE-2026-86239","ts":1789318776288,"field":"exploit_available","old":"true","new":"false"},{"seq":165247,"id":"CVE-2026-86239","ts":1789315790660,"field":"exploit_available","old":"false","new":"true"},{"seq":164042,"id":"CVE-2026-86239","ts":1789313634427,"field":"exploit_available","old":"true","new":"false"},{"seq":162837,"id":"CVE-2026-86239","ts":1789311903642,"field":"exploit_available","old":"false","new":"true"},{"seq":161632,"id":"CVE-2026-86239","ts":1789308733356,"field":"exploit_available","old":"true","new":"false"},{"seq":159745,"id":"CVE-2026-86239","ts":1789300470742,"field":"exploit_available","old":"false","new":"true"},{"seq":156734,"id":"CVE-2026-86239","ts":1789294755835,"field":"exploit_available","old":"true","new":"false"},{"seq":155529,"id":"CVE-2026-86239","ts":1789292968125,"field":"exploit_available","old":"false","new":"true"},{"seq":154324,"id":"CVE-2026-86239","ts":1789289797747,"field":"exploit_available","old":"true","new":"false"},{"seq":151575,"id":"CVE-2026-86239","ts":1789277630045,"field":"exploit_available","old":"false","new":"true"},{"seq":150536,"id":"CVE-2026-86239","ts":1789276245826,"field":"exploit_available","old":"true","new":"false"},{"seq":149503,"id":"CVE-2026-86239","ts":1789273824902,"field":"exploit_available","old":"false","new":"true"},{"seq":148470,"id":"CVE-2026-86239","ts":1789271348900,"field":"exploit_available","old":"true","new":"false"},{"seq":146501,"id":"CVE-2026-86239","ts":1789269398220,"field":"exploit_available","old":"false","new":"true"},{"seq":145306,"id":"CVE-2026-86239","ts":1789266339956,"field":"exploit_available","old":"true","new":"false"},{"seq":144210,"id":"CVE-2026-86239","ts":1789262616930,"field":"exploit_available","old":"false","new":"true"},{"seq":143114,"id":"CVE-2026-86239","ts":1789261533589,"field":"exploit_available","old":"true","new":"false"},{"seq":141945,"id":"CVE-2026-86239","ts":1789258831983,"field":"exploit_available","old":"false","new":"true"},{"seq":140786,"id":"CVE-2026-86239","ts":1789256727302,"field":"exploit_available","old":"true","new":"false"},{"seq":139588,"id":"CVE-2026-86239","ts":1789254832252,"field":"exploit_available","old":"false","new":"true"},{"seq":138390,"id":"CVE-2026-86239","ts":1789251934374,"field":"exploit_available","old":"true","new":"false"},{"seq":137192,"id":"CVE-2026-86239","ts":1789247832972,"field":"exploit_available","old":"false","new":"true"},{"seq":135994,"id":"CVE-2026-86239","ts":1789247056198,"field":"exploit_available","old":"true","new":"false"}]}