FeehiCMS 2.1.1 is configured with 'assets/*' in the backend AccessControl allowActions whitelist (backend/config/main.php, line 176). This whitelist entry makes the entire AssetsController — including the UEditor file upload widget — accessible without any authentication.
The UEditor widget exposes multiple file upload and management actions that can be triggered by unauthenticated attackers: uploadImage, uploadFile (30+ extensions including .txt, .md, .xml, .zip), catchImage, listImage/listFile (file enumeration), and config (full configuration disclosure). Additionally, CSRF protection is explicitly disabled in UeditorAction::init()
FeehiCMS 2.1.1 is configured with 'assets/*' in the backend AccessControl allowActions whitelist (backend/config/main.php, line 176). This whitelist entry makes the entire AssetsController — including the UEditor file upload widget — accessible without any authentication.
The UEditor widget exposes multiple file upload and management actions that can be triggered by unauthenticated attackers: uploadImage, uploadFile (30+ extensions including .txt, .md, .xml, .zip), catchImage, listImage/listFile (file enumeration), and config (full configuration disclosure). Additionally, CSRF protection is explicitly disabled in UeditorAction::init()