Unrated severityNVD Advisory· Published Oct 5, 2026

CVE-2026-95265

Description

Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Feehi CMS/Feehi CMSllm-fuzzy
Range: <2.1.1
Liufee/CMSllm-fuzzy
Range: <2.1.1

Patches

Vulnerability mechanics

References

github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000