CVE-2026-31354: Feehi CMS Authenticated Stored XSS Vulnerabilities in Permissions Module
Summary
CVE-2026-31354: Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Gr... Affects feehi/cms versions 2.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Feehi CMS is a content management system designed for building and managing websites with ease. It offers features such as customizable themes, user management, and various plugins to enhance functionality. However, the Permissions module in Feehi CMS v2.1.1 has been identified to have multiple authenticated stored cross-site scripting (XSS) vulnerabilities, which can be exploited by attackers to execute arbitrary scripts.
Vulnerability Detail
The vulnerabilities stem from improper handling of user input in the Permissions module, specifically through the Group, Category, and Description parameters. Attackers can inject malicious scripts that are stored and executed when other users access the affected areas of the application. This can lead to unauthorized actions, data theft, or further exploitation of the system. The vulnerabilities are classified under CWE-79, indicating a failure to sanitize user input, which is critical for web application security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Permissions module for untrusted users until the patch is applied. This can be done by modifying user roles and permissions in the admin settings to limit access to sensitive areas of the application.
Conclusion
The identified vulnerabilities in Feehi CMS v2.1.1's Permissions module pose a significant risk due to the potential for authenticated stored XSS attacks. It is crucial for users to update to the latest version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for feehi/cms →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts, potentially leading to data theft, unauthorized actions, or further exploitation of the system.
Yes, you can temporarily restrict access to the Permissions module for untrusted users as a workaround until the patch is applied.
You can visit the official Feehi CMS website or their GitHub repository for more details on features and updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for feehi/cms.
