{"id":"CVE-2026-124500","kind":"vulnerability","aliases":["CVE-2026-124500"],"related":[],"title":"Feng Office: file handler lets remote users force server-side requests","description":"A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Feng Office, a self-hosted project and office management web app, has a server-side request forgery flaw in its document image upload function. A remote attacker can make the server send requests to addresses of their choice, such as internal services.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["feng-office","php","runtime","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the installed Feng Office version against the affected range `3.11.13.11` and `4.2.1.2` and below.\n- Look at `application/controllers/FilesController.class.php` for the `upload_document_image` function handling the `url` argument.","fix":null,"status":"open","published_at":"2026-11-09T00:18:01+00:00","first_seen_at":"2026-11-09T00:23:39+00:00","triaged_at":"2026-11-09T00:25:07+00:00","updated_at":"2026-11-09T00:25:07+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-09T00:25:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Feng Office: file handler lets remote users force server-side requests","impact":"medium","summary":"Feng Office, a self-hosted project and office management web app, has a server-side request forgery flaw in its document image upload function. A remote attacker can make the server send requests to addresses of their choice, such as internal services.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["feng-office","self-hosted","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"server makes internal requests on attacker's behalf","analyst_note":"Confirm the fixed version and whether authentication is required for upload_document_image; the NVD entry gives no fix or auth detail.","how_to_check":"- Check the installed Feng Office version against the affected range `3.11.13.11` and `4.2.1.2` and below.\n- Look at `application/controllers/FilesController.class.php` for the `upload_document_image` function handling the `url` argument.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that run Feng Office on their own servers and have it reachable from the network. The sources name the upload_document_image function in the File Handler component and the url argument as the input. Teams on hosted services or on versions newer than the affected range are not named as exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4608,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124500':15A,18A '-2026':14A,17A '/4.2.1.2':84C '3.11.13.11':83C 'address':63B 'app':38B 'application/controllers/filescontroller.class.php':95C 'argument':105C 'attack':55B,115C,133C 'choic':66B 'compon':98C 'contact':137C 'cve':13A,16A 'disclosur':141C 'discov':76C 'document':49B,90C 'earli':138C 'exploit':121C 'feng':1A,20B,27B,79C 'feng-offic':19B 'fengoffic':78C 'file':3A,94C,99C 'flaw':46B,73C 'forc':8A 'forgeri':45B,113C 'function':52B,88C 'handler':4A,100C 'host':26B,32B 'imag':50B,91C 'impact':86C 'intern':69B 'launch':118C 'let':5A 'make':57B 'manag':36B 'manipul':102C 'may':116C,129C 'offic':2A,21B,28B,35B,80C 'php':22B 'project':33B 'public':127C 'releas':124C 'remot':6A,54B,119C 'request':12A,44B,61B,112C 'respond':145C 'result':107C 'runtim':23B 'secur':72C 'self':25B,31B 'self-host':24B,30B 'send':60B 'server':10A,42B,59B,110C 'server-sid':9A,41B,109C 'servic':70B 'side':11A,43B,111C 'upload':51B,89C 'url':106C 'use':131C 'user':7A 'vendor':135C 'way':148C 'web':37B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Feng Office on their own servers and have it reachable from the network. The sources name the upload_document_image function in the File Handler component and the url argument as the input. Teams on hosted services or on versions newer than the affected range are not named as exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fengoffice","medium","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124500':15A,18A '-2026':14A,17A 'cve':13A,16A 'feng':1A 'file':3A 'forc':8A 'handler':4A 'let':5A 'offic':2A 'remot':6A 'request':12A 'server':10A 'server-sid':9A 'side':11A 'user':7A","search_b":"'address':63B 'app':38B 'attack':55B 'choic':66B 'document':49B 'feng':20B,27B 'feng-offic':19B 'flaw':46B 'forgeri':45B 'function':52B 'host':26B,32B 'imag':50B 'intern':69B 'make':57B 'manag':36B 'offic':21B,28B,35B 'php':22B 'project':33B 'remot':54B 'request':44B,61B 'runtim':23B 'self':25B,31B 'self-host':24B,30B 'send':60B 'server':42B,59B 'server-sid':41B 'servic':70B 'side':43B 'upload':51B 'web':37B","search_c":"'/4.2.1.2':84C '3.11.13.11':83C 'application/controllers/filescontroller.class.php':95C 'argument':105C 'attack':115C,133C 'compon':98C 'contact':137C 'disclosur':141C 'discov':76C 'document':90C 'earli':138C 'exploit':121C 'feng':79C 'fengoffic':78C 'file':94C,99C 'flaw':73C 'forgeri':113C 'function':88C 'handler':100C 'imag':91C 'impact':86C 'launch':118C 'manipul':102C 'may':116C,129C 'offic':80C 'public':127C 'releas':124C 'remot':119C 'request':112C 'respond':145C 'result':107C 'secur':72C 'server':110C 'server-sid':109C 'side':111C 'upload':89C 'url':106C 'use':131C 'vendor':135C 'way':148C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:18:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124500","severity":null,"published_at":"2026-11-09T00:18:01+00:00","modified_at":"2026-11-09T00:18:01+00:00","first_seen_at":"2026-11-09T00:23:39+00:00","fetched_at":"2026-11-09T00:23:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}