CVE-2026-86240

liufee FeehiCMS up to version 2.1.1 contains a server-side request forgery (SSRF) vulnerability in the catchImage function of the file backend/widgets/ueditor/Uploader.php (UEditor component). Manipulation of the source[] argument enables remote attackers to forge server-side requests. A proof-of...