CVE-2026-36669
An unauthenticated attacker can upload any file to a web‑accessible directory in Feng Office 3.11.13.11. The flaw is in the file‑upload handler and allows the attacker to place malicious files on the server.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running Feng Office 3.11.13.11 who have the ck_upload_handler.php component enabled and allow file uploads.
Real-world impact
An attacker could upload a malicious HTML or other file that anyone could access, potentially leading to code execution or data theft.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑reachable, requires no authentication, and gives the attacker the ability to upload arbitrary files, which can be used to compromise the web server or host malicious content.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 17, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.