Feng Office Community Edition Unauthenticated Arbitrary File Upload and Stored XSS (CVE-2026-36669)

Vulnerability Overview CVE-2026-36669: An unauthenticated arbitrary file upload vulnerability exists in Feng Office Community Edition. Attackers can upload arbitrary files (including malicious or scripts) to a web-accessible directory. Due to the lack of session cookie protection, this vulnerability can lead to stored Cross-Site Scripting (XSS) and administrator session hijacking. --- Affected Scope Affected Product: Feng Office Community Edition Affected Versions: 3.11.13.11 and earlier Vulnerability Type: Unauthenticated file upload (CWE-434), Lack of authentication for critical function (CWE-306) Exploitation Status: Proof of Concept verified Remediation Status: Unpatched (Vendor notified, but no patch available within the standard disclosure window) --- Remediation 1. Enforce Authentication Ensure that checks for an active administrator session before processing any file upload. 2. Re-enable Server-Side File Validation Uncomment and strictly enforce extension checks, rejecting any uploads that do not match expected non-executable image MIME types: 3. Enforce HttpOnly Cookies Modify the PHP configuration or application bootstrap configuration to ensure that session cookies are not accessible via client-side script APIs: --- Proof of Concept (PoC) Code Request Example: Content of : Expected Response (if vulnerable): --- Disclosure Timeline February 20, 2026: Initial vulnerability discovered and reported to Feng Office support team. March 12, 2026: CVE identifier requested from MITRE. March 15, 2026: Vendor confirmed receipt of the report and requested a pause on review. March 29, 2026: MITRE formally assigned CVE-2026-36669. June 29, 2026: Final notice sent, outlining the 14-day standard disclosure timeline. July 13, 2026: Coordinated response/patch window expired with no response. July 15, 2026: Public disclosure of this security advisory. --- Discoverer Soufiane LAGZIRI

Goal Reached Thanks to every supporter — we hit 100%!

Feng Office Community Edition Unauthenticated Arbitrary File Upload and Stored XSS (CVE-2026-36669)

More from this source