FeehiCMS 2.1.1 includes a UEditor widget with a catchImage action that fetches remote images. The IP address validation in saveRemote() (backend/widgets/ueditor/Uploader.php, line 235) uses PHP's FILTER_FLAG_NO_PRIV_RANGE filter, which only blocks private network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but does not filter loopback addresses (127.0.0.0/8) or link-local addresses (169.254.0.0/16).
Combined with the assets/* whitelist (see FEHI-001), an unauthenticated attacker can send HTTP requests to the server's loopback interface, perform internal port scanning, access internal services, and potentially reach cloud metadata endpoints.
FeehiCMS 2.1.1 includes a UEditor widget with a catchImage action that fetches remote images. The IP address validation in saveRemote() (backend/widgets/ueditor/Uploader.php, line 235) uses PHP's FILTER_FLAG_NO_PRIV_RANGE filter, which only blocks private network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) but does not filter loopback addresses (127.0.0.0/8) or link-local addresses (169.254.0.0/16).
Combined with the assets/* whitelist (see FEHI-001), an unauthenticated attacker can send HTTP requests to the server's loopback interface, perform internal port scanning, access internal services, and potentially reach cloud metadata endpoints.