---
id: CVE-2026-95264
title: Feehi CMS 2.1.1 is vulnerable to Directory Traversal
summary: >-
  Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend
  user with article edit permission can delete arbitrary files writable by the
  PHP process. Article image metadata is used to construct a filesystem path and
  is…
severity: none
published: '2026-10-05'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T20:17:29.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95264'
references:
  - url: 'https://github.com/liufee/cms'
    label: cve@mitre.org
  - url: 'https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95264.md'
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-05T20:32:56.656Z'
---

## Overview

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to `unlink()` without path traversal or directory validation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.