{"id":"CVE-2026-95265","published":"2026-10-05T20:17:29.313","lastModified":"2026-10-06T15:17:20.310","description":"Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/liufee/cms","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/liufee/cms","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md","tags":[]},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md","tags":[]}],"hasPoc":true,"ai":{"summary":"CVE-2026-95265 is a Server-Side Request Forgery (SSRF) vulnerability in Feehi CMS 2.1.1's UEditor catchimage endpoint that allows attackers to probe internal HTTP services by bypassing private IP validation. This flaw enables attackers to map internal networks and potentially access sensitive internal systems.","exploitability":"The exploit is relatively straightforward with no special preconditions needed, requiring only HTTP access to the vulnerable UEditor endpoint to perform SSRF attacks against internal services.","blast_radius":"If exploited, this vulnerability could allow attackers to discover internal network services, potentially leading to unauthorized access to internal databases, application servers, or other sensitive systems behind firewalls.","remediation":"Upgrade to Feehi CMS 2.1.2 or later to address this SSRF vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ssrf","cms","web"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:03:02.740Z"}}