TI-2026-68309 Aliases CVE-2026-105389 GHSA-f8wx-vh68-3c39

feelec-yishu feelcrm-os UploadTicketFile unrestricted file upload

MEDIUM 57CWE-284Published 2026-10-05 · Updated 2026-10-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass, Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284 and CWE-434.

Summary

A remote attacker can upload files without restriction through the UploadTicketFile endpoint in feelec-yishu feelcrm-os 1.0.0, in the file App/Feelcrm/Crm/Controller/UploadController.class.php, by manipulating the cmd argument. The flaw is classified as unrestricted upload of a file with a dangerous type (CWE-434) and improper access control (CWE-284). The exploit has been publicly disclosed and may be used, and the project has not responded to an early issue report.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00209 11th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
feelec-yishu	feelcrm-os	1.0.0	—	No fix listed	CNA

feelcrm-os Vendorfeelec-yishu Affected 1.0.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:feelec-yishu:feelcrm-os::::::::	—	—	—

cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for feelec-yishu feelcrm-os.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-06 Threatist record created from CVE-2026-105389
2026-10-06 Alias added: GHSA-f8wx-vh68-3c39
2026-10-07 CISA SSVC decision points changed
2026-10-07 Priority changed: LOW → MEDIUM

References

Exploit 1

https://github.com/feelec-yishu/feelcrm-os/issues/7

Other 1

https://github.com/feelec-yishu/feelcrm-os/

TI-2026-67724 feelec-yishu feelcrm-os server-side request forgery in getCurlData CVSS 4.0MEDIUM 6.9
TI-2026-67885 SQL injection in feelec-yishu feelcrm-os Member Endpoint CVSS 4.0MEDIUM 5.3
TI-2026-67725 Cross-site scripting in feelec-yishu feelcrm-os department search CVSS 4.0MEDIUM 5.3
TI-2026-67722 feelec-yishu feelcrm-os cross-site scripting in Crm Endpoint CVSS 4.0MEDIUM 5.3
TI-2026-67721 SQL injection in feelec-yishu feelcrm-os getMemberByGroups endpoint CVSS 4.0MEDIUM 5.3
TI-2026-67723 Cross-site scripting in feelec-yishu feelcrm-os customer form CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences