CVE-2026-31352: Feehi CMS Authenticated Stored XSS Vulnerability in Role Management Module
Summary
CVE-2026-31352: An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Role N... Affects feehi/cms versions 2.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Feehi CMS is a content management system designed for building and managing websites. It offers features such as user management, role-based access control, and customizable templates. However, the Role Management module in Feehi CMS v2.1.1 contains a vulnerability that allows authenticated users to inject malicious scripts, compromising the security of the application.
Vulnerability Detail
An authenticated stored cross-site scripting (XSS) vulnerability exists in the Role Management module of Feehi CMS v2.1.1. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Role Name parameter. If exploited, this can lead to unauthorized actions, data theft, or further attacks on users of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the Role Management module to trusted users only. This can help mitigate the risk of exploitation until a patch is applied.
Conclusion
The authenticated stored XSS vulnerability in Feehi CMS's Role Management module poses a significant risk to applications using this version. It is crucial to update to the latest version to mitigate this risk and protect user data.
See every vulnerability recorded for feehi/cms →
FAQ
An authenticated stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored and executed in the context of other users who access the affected application.
If exploited, this vulnerability can allow attackers to execute scripts that may steal user data, perform actions on behalf of users, or spread malware.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If you cannot update the package, implement access controls to limit who can use the Role Management module as a temporary measure.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for feehi/cms.
