CVE-2026-124499 · Package
NO FIX YET
Feng Office, a web-based office and project management application, has a code injection flaw in its Translation Tool's write_translations function, where the lang argument is not properly handled. A remote attacker could inject code that the server runs, and a public exploit is available.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running self-hosted Feng Office at versions up to 3.11.13.11 or 4.2.1.2 that expose the web interface to the network. The sources do not say whether the Translation Tool needs to be enabled or whether an account is required, so teams should assume the flaw is reachable if the application is internet-facing.
Not affected if unknown
Who cares feng-office, php, self-hosted
3.11.13.11 and 4.2.1.2.application/controllers/ToolController.class.php and confirm whether it contains write_translations.No fix yet, per the sources.
A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.