CVE-2026-114256 in file-management-system-php
Summary
by MITRE • 10/21/2026
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the oretnom23 file-management-system-php application, specifically affecting versions up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This software utilizes a rolling release strategy for continuous delivery, which complicates the precise identification of affected version numbers as updates are deployed continuously rather than through discrete major releases. The core technical flaw is located in the admin_class.php file within the Folder Management component, impacting functions responsible for saving folders, deleting folders and files, renaming files, and handling bulk file saves. These operations accept user-supplied arguments including name, parent_id, id, type, folder_id, and description. Due to insufficient input validation or improper sanitization of these parameters before their inclusion in database queries, the application is susceptible to SQL injection attacks. This represents a classic instance of CWE-89 Improper Neutralization of Special Elements used in an SQL Command allowing attackers to manipulate backend database structures.
The operational impact of this vulnerability is severe given its remote exploitability and the administrative nature of the affected functions. An attacker can execute arbitrary SQL commands against the underlying database, potentially leading to unauthorized data access, modification, or deletion. Since the vulnerable endpoints are part of an admin class, successful exploitation may allow a malicious actor to escalate privileges if authentication bypasses exist or if they possess valid but low-privileged credentials that interact with these specific file management features. The availability of public exploits significantly lowers the barrier for entry, enabling less sophisticated threat actors to compromise the system. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter where SQL commands are effectively used as a script to manipulate data or execute administrative tasks on the database server.
The project maintainers were notified of this security issue via an official issue report but have not yet provided a response or issued a patch. This lack of immediate remediation leaves users exposed until a fix is developed and deployed within their rolling release pipeline. Organizations relying on this file management system must treat it as compromised in its current state if accessed over untrusted networks. Mitigation strategies should focus on network-level controls such as Web Application Firewalls to detect and block SQL injection patterns, strict input validation at the application layer for all listed parameters, and ensuring that database accounts used by the application adhere to the principle of least privilege. Additionally, until a patch is available, administrators should restrict access to the admin interface to trusted IP addresses only and monitor logs for anomalous query patterns indicative of exploitation attempts.