{"id":"CVE-2026-124499","kind":"vulnerability","aliases":["CVE-2026-124499"],"related":[],"title":"Feng Office: Translation Tool lets remote users inject code via lang argument","description":"A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Feng Office, a web-based office and project management application, has a code injection flaw in its Translation Tool's write_translations function, where the lang argument is not properly handled. A remote attacker could inject code that the server runs, and a public exploit is available.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["feng-office","package","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Feng Office version against the affected range: up to `3.11.13.11` and `4.2.1.2`.\n- Look for the file `application/controllers/ToolController.class.php` and confirm whether it contains `write_translations`.","fix":null,"status":"open","published_at":"2026-11-09T00:18:00+00:00","first_seen_at":"2026-11-09T00:23:39+00:00","triaged_at":"2026-11-09T00:25:07+00:00","updated_at":"2026-11-09T00:25:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T00:25:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown. The vendor did not respond to the disclosure and the sources state no fixed version.","reach":"internet","title":"Feng Office: Translation Tool lets remote users inject code via lang argument","impact":"high","summary":"Feng Office, a web-based office and project management application, has a code injection flaw in its Translation Tool's write_translations function, where the lang argument is not properly handled. A remote attacker could inject code that the server runs, and a public exploit is available.","audience":"businesses","category":"package","nicknames":[],"who_cares":["feng-office","self-hosted","php"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Remote code runs on the Feng Office server.","analyst_note":"Confirm whether the Translation Tool is enabled by default and whether authentication is required; check NVD and the disclosure for any fixed version or workaround.","how_to_check":"- Check the installed Feng Office version against the affected range: up to `3.11.13.11` and `4.2.1.2`.\n- Look for the file `application/controllers/ToolController.class.php` and confirm whether it contains `write_translations`.\n- unknown whether the Translation Tool is enabled by default.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running self-hosted Feng Office at versions up to 3.11.13.11 or 4.2.1.2 that expose the web interface to the network. The sources do not say whether the Translation Tool needs to be enabled or whether an account is required, so teams should assume the flaw is reachable if the application is internet-facing.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00076,"input_tokens":4599,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124499':15A,18A '-2026':14A,17A '/4.2.1.2':86C '3.11.13.11':85C 'affect':88C 'applic':37B 'application/controllers/toolcontroller.class.php':96C 'argument':12A,54B,106C 'attack':61B,113C 'avail':74B,122C 'base':32B 'code':9A,40B,64B,110C 'compon':99C 'contact':130C 'could':62B 'cve':13A,16A 'disclosur':134C 'earli':131C 'exploit':72B,119C 'feng':1A,20B,27B,81C 'feng-offic':19B 'fengoffic':80C 'file':95C 'flaw':42B 'function':50B,90C 'handl':58B 'host':26B 'identifi':78C 'initi':116C 'inject':8A,41B,63B,111C 'lang':11A,53B,107C 'lead':108C 'let':5A 'manag':36B 'manipul':103C 'may':114C 'might':124C 'offic':2A,21B,28B,33B,82C 'packag':22B 'php':23B 'project':35B 'proper':57B 'public':71B,121C 'remot':6A,60B,117C 'respond':138C 'run':68B 'self':25B 'self-host':24B 'server':67B 'tool':4A,46B,101C 'translat':3A,45B,49B,92C,100C 'use':126C 'user':7A 'vendor':128C 'via':10A 'vulner':76C 'way':141C 'web':31B 'web-bas':30B 'write':48B,91C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted Feng Office at versions up to 3.11.13.11 or 4.2.1.2 that expose the web interface to the network. The sources do not say whether the Translation Tool needs to be enabled or whether an account is required, so teams should assume the flaw is reachable if the application is internet-facing.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fengoffice","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-124499':15A,18A '-2026':14A,17A 'argument':12A 'code':9A 'cve':13A,16A 'feng':1A 'inject':8A 'lang':11A 'let':5A 'offic':2A 'remot':6A 'tool':4A 'translat':3A 'user':7A 'via':10A","search_b":"'applic':37B 'argument':54B 'attack':61B 'avail':74B 'base':32B 'code':40B,64B 'could':62B 'exploit':72B 'feng':20B,27B 'feng-offic':19B 'flaw':42B 'function':50B 'handl':58B 'host':26B 'inject':41B,63B 'lang':53B 'manag':36B 'offic':21B,28B,33B 'packag':22B 'php':23B 'project':35B 'proper':57B 'public':71B 'remot':60B 'run':68B 'self':25B 'self-host':24B 'server':67B 'tool':46B 'translat':45B,49B 'web':31B 'web-bas':30B 'write':48B","search_c":"'/4.2.1.2':86C '3.11.13.11':85C 'affect':88C 'application/controllers/toolcontroller.class.php':96C 'argument':106C 'attack':113C 'avail':122C 'code':110C 'compon':99C 'contact':130C 'disclosur':134C 'earli':131C 'exploit':119C 'feng':81C 'fengoffic':80C 'file':95C 'function':90C 'identifi':78C 'initi':116C 'inject':111C 'lang':107C 'lead':108C 'manipul':103C 'may':114C 'might':124C 'offic':82C 'public':121C 'remot':117C 'respond':138C 'tool':101C 'translat':92C,100C 'use':126C 'vendor':128C 'vulner':76C 'way':141C 'write':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:18:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124499","severity":null,"published_at":"2026-11-09T00:18:00+00:00","modified_at":"2026-11-09T00:18:01+00:00","first_seen_at":"2026-11-09T00:23:39+00:00","fetched_at":"2026-11-09T00:23:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}