What is GHSA-8j78-3wr5-vjqm?

GHSA-8j78-3wr5-vjqm is a security advisory published by GitHub Security Advisories with Medium severity. Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article...

Which CVE IDs does GHSA-8j78-3wr5-vjqm cover?

GHSA-8j78-3wr5-vjqm covers the following CVE IDs: CVE-2026-95264. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8j78-3wr5-vjqm?

GHSA-8j78-3wr5-vjqm has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-8j78-3wr5-vjqmMediumCVSS 6.5

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article...

Vendor

GitHub Security Advisories

Published

October 5, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-95264 →

📋 Description

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink() without path traversal or directory validation.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-95264
https://github.com/liufee/cms
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95264.md
https://github.com/advisories/GHSA-8j78-3wr5-vjqm