firstlax6t/cve-2026-36669-fengofficeDetailed security advisory for CVE-2026-36669: unauthenticated arbitrary file upload in Feng Office, enabling stored XSS and session hijacking. Includes technical analysis, PoC, and remediation steps.
An unauthenticated arbitrary file upload vulnerability exists in ck_upload_handler.php in Feng Office Community Edition (version 3.11.13.11). This flaw allows remote, unauthenticated attackers to upload arbitrary files (including malicious .html or .php scripts) to a web-accessible directory. When combined with the lack of administrative cookie protections (HttpOnly), this vulnerability can lead to Stored Cross-Site Scripting (XSS) and administrative session hijacking.
| Metric | Details |
|---|
| CVE Identifier | CVE-2026-36669 |
| Vulnerability Type | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| Associated Weakness | Missing Authentication for Critical Function (CWE-306) |
| Affected Product | Feng Office Community Edition |
| Affected Versions | Version 3.11.13.11 (and potentially earlier versions) |
| Exploitation Status | Proof of Concept Verified |
| Remediation Status | Unpatched (Vendor notified, no patch provided within the standard disclosure window) |
The endpoint ck_upload_handler.php acts as a standalone script. It does not load or inherit the main application's authentication middleware or access control lists (ACL). Consequently, any external request sent directly to this script is treated as authenticated.
In the source code of ck_upload_handler.php, the server-side file validation logic (lines 21–25) designed to restrict uploads to specific image formats (.jpg, .png, .gif) has been explicitly commented out:
// $pattern = "/\.(jpg|png|gif)$/i";
// if (!preg_match($pattern,$_FILES['upload']['name'])) {
// ...
// }
Because this regex constraint is inactive, the file upload mechanism accepts any user-supplied extension.
The script utilizes the PHP copy() function to write the uploaded files directly into the /tmp/ directory, which is configured to be web-accessible.
The global configuration file application/config/config.php does not enforce the HttpOnly flag on session cookies. When an attacker uploads an .html file containing client-side script blocks, any administrator who views the file will execute the script within the context of their active session. This allows attackers to silently extract active administrative session tokens.
Notice: This Proof of Concept is provided for educational and defensive auditing purposes only.
To verify the vulnerability, send a multipart POST request containing a harmless verification file (e.g., test.html) to the endpoint, appending the required CKEditorFuncNum parameter:
curl -i -X POST \
-F "[email protected]" \
"http://<target-domain>/ck_upload_handler.php?CKEditorFuncNum=1"
Where test.html contains basic proof-of-concept HTML markup:
<!DOCTYPE html>
<html>
<body>
<script>
alert("Vulnerability Verified: " + document.cookie);
</script>
</body>
</html>
If vulnerable, the server will reply with a 200 OK status and output a JavaScript block indicating the upload path:
<script type="text/javascript">
window.parent.CKEDITOR.tools.callFunction("1", "/tmp/test.html", "");
</script>
If you run an affected version of Feng Office, apply the following manual hotfixes to secure the file upload endpoint:
Ensure that ck_upload_handler.php checks for active administrative sessions before processing any file upload logic.
Uncomment and strictly enforce extension checks. Reject any uploads that do not explicitly match expected non-executable image MIME-types:
$pattern = "/\.(jpg|jpeg|png|gif)$/i";
if (!preg_match($pattern, $_FILES['upload']['name'])) {
header("HTTP/1.1 403 Forbidden");
exit("Invalid file type.");
}
Modify your PHP configuration or application bootstrap configuration to ensure that session cookies are not accessible via client-side scripting APIs:
session.cookie_httponly = On
Soufiane LAGZIRI