GHSA-mcxq-54f4-mmx5

FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-65657

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	feehi/cms	<= 2.1.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-65657 advisory
https://github.com/liufee/cms/issues/78 web
https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md web
https://github.com/liufee/cms package