CVE-2025-65657

FeehiCMS version 2.1.1 contains a remote code execution vulnerability via unrestricted file upload in the Ad Management module. The application fails to properly validate, sanitize, or enforce execution restrictions on uploaded files, allowing arbitrary file types to be stored in executable locations [1][2].

An authenticated attacker with backend access can navigate to Ad Management, upload a file, and intercept the request to modify the file extension from a benign type (e.g., JPEG) to PHP. The crafted PHP file, containing malicious code, is then stored on the server at a known path [1][4].

Successful exploitation enables the attacker to execute arbitrary system commands on the underlying server, compromising the confidentiality and integrity of the application and its data. The CVSS score is 9.6 (Critical) per the provided reference [2].

As of the advisory, no official patch has been released. The vendor, liufee, maintains the project on GitHub [3]. Mitigation involves implementing strict file type validation, disabling execution of uploaded files, or applying web server controls to prevent execution of user-uploaded content.