CVE-2026-36669 Details
Description
An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/ directory.
A vulnerability allowing unauthenticated arbitrary file uploads has been identified in Feng Office Community Edition version 3.11.13.11. The issue resides in the file 'ck_upload_handler.php', where the server-side validation for file extensions has been disabled. This flaw enables remote attackers to upload malicious files, such as '.html' or '.php' scripts, to the web-accessible '/tmp/' directory. The vulnerability is exacerbated by the absence of 'HttpOnly' flags on session cookies, potentially leading to stored cross-site scripting (XSS) and administrative session hijacking.
Users are advised to implement authentication checks in 'ck_upload_handler.php' to verify active administrative sessions before processing file uploads. Additionally, re-enable server-side file validation by uncommenting the extension checks to allow only non-executable image formats. Finally, ensure that session cookies are set with the 'HttpOnly' flag to prevent access via client-side scripts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/firstlax6t/CVE-2026-36669-FengOffice | CISA-ADP | AdvisoryExploitRemedy |
| https://github.com/firstlax6t/CVE-2026-36669-FengOffice | [email protected] | AdvisoryExploitRemedy |
| https://www.fengoffice.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Feng Office | 3.11.13.11 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |