CVE-2026-95265

Executive Summary

Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation logic within this endpoint fails to block loopback (e.g., 127.0.0.1) and link-local (e.g., 169.254.0.0/16) addresses. An unauthenticated or low-privileged attacker can exploit this flaw to force the server to probe internal HTTP services, using response timing or content differences to map internal network topology and potentially access sensitive internal resources. Given the lack of a vendor patch and the absence of public exploit code, this vulnerability represents a persistent, high-impact risk for internet-facing Feehi CMS deployments.

Technical Analysis

Feehi CMS is a PHP-based content management system. Version 2.1.1 integrates the UEditor rich-text editor, which exposes a catchimage endpoint. This endpoint is designed to fetch remote images from user-supplied URLs and save them locally, a common feature in CMS platforms for content ingestion.

The core vulnerability is a Server-Side Request Forgery (SSRF) with an insufficient denylist. According to the NVD description, the "private-IP validation does not block loopback or link-local addresses." This indicates that the application attempts to prevent SSRF by filtering requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but fails to account for:

• Loopback addresses: 127.0.0.0/8 (e.g., 127.0.0.1, localhost)
• Link-local addresses: 169.254.0.0/16 (used for APIPA and cloud metadata services, e.g., 169.254.169.254)

An attacker can supply a crafted URL to the catchimage endpoint. Because the validation is incomplete, the server will initiate an HTTP request to the specified address. The attacker can then observe the server's response—whether it is a successful image fetch, an error message, a timeout, or a specific HTTP status code—to infer information about internal services. This is a classic blind SSRF scenario where response differences (content length, timing, error messages) serve as an oracle.

The attack surface is the catchimage endpoint, which is typically accessible without authentication in UEditor integrations, or at least accessible to any user with content creation privileges. The lack of a CVE-assigned CVSS score from NVD means the severity is currently unquantified by the vendor, but the potential for internal network reconnaissance and metadata service access warrants a high-severity classification.

Exploitation Scenarios

The attack chain for this SSRF vulnerability is inferred from the vulnerability class and the limited technical detail available. No public PoC exists; the following is a conceptual exploitation path.

1. Reconnaissance and Target Identification: The attacker identifies a Feehi CMS 2.1.1 instance by fingerprinting the UEditor endpoint. Common UEditor paths include /ueditor/php/controller.php with an action=catchimage parameter, though the exact URL structure is not specified in the NVD description. The attacker confirms the presence of the catchimage functionality, which is typically used for remote image fetching.

2. Triggering the Flaw: The attacker sends a crafted request to the catchimage endpoint. The request includes a source[] parameter (or similar, as per UEditor's standard API) containing a URL pointing to a loopback or link-local address. For example, the attacker might submit http://127.0.0.1:80/ or http://169.254.169.254/latest/meta-data/. The server-side validation fails to block these addresses, and the application attempts to fetch the resource.

3. Payload and Execution Method: The "payload" is the URL itself. The attacker does not need to inject code; they simply supply a malicious URL. The server processes this URL, making an HTTP request to the internal address. The attacker can use different ports, paths, and protocols (if supported) to probe for internal services. Since this is a blind SSRF, the attacker relies on response differences: a fast response with a 200 status might indicate an open port, a timeout might indicate a firewall, and an error message might reveal the service type.

4. Post-Exploitation Impact: Successful exploitation allows the attacker to map the internal network, identify open ports, and potentially interact with unauthenticated internal services. The most critical risk is accessing cloud instance metadata services (e.g., AWS EC2 at 169.254.169.254), which can lead to the theft of IAM credentials, API keys, and other sensitive configuration data. The attacker could also use the server as a proxy to bypass network segregation and attack other internal systems. The SSRF could be used to read local files if the catchimage endpoint supports file:// or other protocols, though this is not explicitly stated in the description.

Impact Assessment

The impact of this SSRF vulnerability is significant. While the CVSS score is currently unassigned, the potential for internal network reconnaissance, cloud metadata theft, and lateral movement justifies a high severity rating. The attack vector is network-accessible (AV:N), requires no authentication (PR:N) or user interaction (UI:N), and can result in a scope change (S:C) as the vulnerable component (Feehi CMS) is used to attack other internal components. Confidentiality impact is high (C:H) due to the potential exposure of sensitive internal data, while integrity and availability impacts are typically none (I:N/A:N) for a pure reconnaissance SSRF, though they could be higher if internal services are manipulated.

The blast radius includes all internal systems reachable from the vulnerable server, particularly cloud metadata endpoints and administrative interfaces. For organizations hosting Feehi CMS in a cloud environment (AWS, GCP, Azure), the risk of credential compromise is severe. The lack of a patch means the vulnerability remains exploitable indefinitely, and the absence of public exploit code does not mitigate the risk, as the attack is trivial to implement manually.

Detection Guidance

Sigma Rule

title: Feehi CMS UEditor catchimage SSRF Attempt
id: 8f2a1c3e-5b7d-4e9f-8a1b-2c3d4e5f6a7b
status: experimental
description: Detects attempts to exploit SSRF in Feehi CMS 2.1.1 UEditor catchimage endpoint by targeting loopback or link-local addresses.
author: Threat Intelligence
date: 2026-06-15
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection_endpoint:
    cs-uri-query|contains: 'catchimage'
  selection_payload:
    cs-uri-query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - '0.0.0.0'
      - '::1'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate administrative activity
level: high

YARA Rule

rule Feehi_CMS_SSRF_CatchImage
{
    meta:
        description = "Detects URLs targeting loopback or link-local addresses in web requests, indicative of SSRF exploitation in Feehi CMS 2.1.1"
        author = "Threat Intelligence"
        date = "2026-06-15"
        reference = "CVE-2026-95265"
    strings:
        $catchimage = "catchimage" ascii wide nocase
        $loopback1 = "127.0.0.1" ascii wide
        $loopback2 = "localhost" ascii wide nocase
        $linklocal = "169.254.169.254" ascii wide
        $linklocal2 = "169.254." ascii wide
    condition:
        $catchimage and any of ($loopback*) or ($linklocal*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95265 Feehi CMS UEditor catchimage SSRF Attempt"; flow:to_server,established; content:"catchimage"; http_uri; content:"127.0.0.1"; http_uri; nocase; sid:10000001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-95265 Feehi CMS UEditor catchimage SSRF Attempt (Link-Local)"; flow:to_server,established; content:"catchimage"; http_uri; content:"169.254.169.254"; http_uri; nocase; sid:10000002; rev:1;)

Elastic Detection

sequence by host.id
  [network where process.name in ("httpd", "apache2", "nginx", "php-fpm") and url.query : "*catchimage*" and url.query : ("*127.0.0.1*" or "*localhost*" or "*169.254.*" or "*0.0.0.0*")]

Splunk SPL Query

index=web_logs source="*access*" uri_query="*catchimage*"
| search uri_query="*127.0.0.1*" OR uri_query="*localhost*" OR uri_query="*169.254.*" OR uri_query="*0.0.0.0*"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, uri_path, uri_query, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,ssrf,">
  <rule id="100200" level="12">
    <decoded_as>web</decoded_as>
    <url>catchimage</url>
    <regex>127\.0\.0\.1|localhost|169\.254\.|0\.0\.0\.0</regex>
    <description>CVE-2026-95265: Feehi CMS UEditor catchimage SSRF attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the UEditor catchimage endpoint if not required. This can be done by removing or renaming the controller file or blocking access via web server configuration (e.g., Apache/Nginx location rules).
   • Implement a strict allowlist of permitted domains/IPs for remote image fetching, ensuring that loopback, link-local, and private IP ranges are explicitly blocked.
   • Apply network-level egress filtering to prevent the web server from making outbound requests to loopback and link-local addresses (e.g., using iptables or cloud security groups).
   • Deploy a Web Application Firewall (WAF) with virtual patching rules that block requests to the catchimage endpoint containing URLs with loopback or link-local addresses.

2. Patch/Upgrade Steps:

   • No official patch is available for Feehi CMS 2.1.1. Monitor the vendor's official channels for updates. If a patched version is released, upgrade immediately.
   • If the vendor remains unresponsive, consider migrating to a supported CMS or applying a custom code fix that enhances the private-IP validation to include loopback (127.0.0.0/8, ::1) and link-local (169.254.0.0/16, fe80::/10) ranges.

3. Long-Term Hardening:

   • Conduct a security review of all third-party components (like UEditor) integrated into the CMS.
   • Implement a robust SSRF prevention library that resolves DNS and validates all IP addresses before making requests.
   • Enforce the principle of least privilege for the web server process, limiting its ability to make arbitrary network requests.
   • Regularly scan for and remediate known vulnerabilities in all software components.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-95265
• Feehi CMS Official Website: https://www.feehi.com/
• UEditor GitHub Repository: https://github.com/fex-team/ueditor
• CWE-918: Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• OWASP SSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
• No known threat actor campaigns or exploit-in-the-wild evidence is currently available.