---
id: "CVE-2026-124499"
page: "https://infrastack.ai/live/CVE-2026-124499"
kind: "vulnerability"
aliases: ["CVE-2026-124499"]
title: "Feng Office: Translation Tool lets remote users inject code via lang argument"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["feng-office", "package", "php", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-09T00:18:00+00:00"
first_seen_at: "2026-11-09T00:23:39+00:00"
updated_at: "2026-11-09T00:25:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124499", "first_seen_at": "2026-11-09T00:23:39+00:00"}]
exploit_sources: []
---

# Feng Office: Translation Tool lets remote users inject code via lang argument

Link for people: https://infrastack.ai/live/CVE-2026-124499 (this .md is for agents)

Feng Office, a web-based office and project management application, has a code injection flaw in its Translation Tool's write_translations function, where the lang argument is not properly handled. A remote attacker could inject code that the server runs, and a public exploit is available.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Feng Office version against the affected range: up to `3.11.13.11` and `4.2.1.2`.
- Look for the file `application/controllers/ToolController.class.php` and confirm whether it contains `write_translations`.

## Timeline

- 2026-11-09T00:23:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124499

## From the sources

A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_