CVE-2026-124499 Details
Description
A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A code injection vulnerability has been identified in Fengoffice versions through 3.11.13.11 and 4.2.1.2. The issue resides in the Translation Tool component, specifically within the 'write_translations' function of 'application/controllers/ToolController.class.php'. The vulnerability allows authenticated Super Administrators to inject arbitrary PHP code into generated language files, which can then be executed with the privileges of the web server user. The injection is achieved by manipulating the 'lang' argument, with the exploit being publicly available.
To address this vulnerability, it is recommended to validate translation keys against a strict allowlist regex before writing them to language files. Additionally, user-generated translations should be stored in JSON or data files instead of PHP, and the Translation Tool should be removed from production builds.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Marsh232/6dd58742d417911fed6dd2c94c85378a | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-124499 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1033307 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432804 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432804/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fengoffice Feng Office | >= 3.4.3-rc, <= 3.11.13.11 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |