CVE-2026-95265

Summary

CVE-2026-95265 is a Server-Side Request Forgery (SSRF) vulnerability in Feehi CMS 2.1.1's UEditor catchimage endpoint that allows attackers to probe internal HTTP services by bypassing private IP validation. This flaw enables attackers to map internal networks and potentially access sensitive internal systems.

Exploitability

The exploit is relatively straightforward with no special preconditions needed, requiring only HTTP access to the vulnerable UEditor endpoint to perform SSRF attacks against internal services.

Blast radius

If exploited, this vulnerability could allow attackers to discover internal network services, potentially leading to unauthorized access to internal databases, application servers, or other sensitive systems behind firewalls.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Feehi CMS 2.1.2 or later to address this SSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.