---
id: "CVE-2026-124500"
page: "https://infrastack.ai/live/CVE-2026-124500"
kind: "vulnerability"
aliases: ["CVE-2026-124500"]
title: "Feng Office: file handler lets remote users force server-side requests"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["feng-office", "php", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-09T00:18:01+00:00"
first_seen_at: "2026-11-09T00:23:39+00:00"
updated_at: "2026-11-09T00:25:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124500", "first_seen_at": "2026-11-09T00:23:39+00:00"}]
exploit_sources: []
---

# Feng Office: file handler lets remote users force server-side requests

Link for people: https://infrastack.ai/live/CVE-2026-124500 (this .md is for agents)

Feng Office, a self-hosted project and office management web app, has a server-side request forgery flaw in its document image upload function. A remote attacker can make the server send requests to addresses of their choice, such as internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Feng Office version against the affected range `3.11.13.11` and `4.2.1.2` and below.
- Look at `application/controllers/FilesController.class.php` for the `upload_document_image` function handling the `url` argument.

## Timeline

- 2026-11-09T00:23:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124500

## From the sources

A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_