CVE-2026-114258 in file-management-system-php
Summary
by MITRE • 10/21/2026
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The oretnom23 file-management-system-php application contains a critical security flaw within its File Management component, specifically located in the files.php script. This vulnerability arises from improper neutralization of special elements used in SQL commands, commonly known as SQL injection. The root cause is traced to the manipulation of input arguments labeled fid or id, which are passed directly into database queries without adequate sanitization or parameterization. Because these parameters control file identification and retrieval operations, an attacker can inject malicious SQL code that alters the intended logic of the backend database query. This flaw allows for unauthorized access to sensitive data stored within the system's database, potentially including user credentials, private files, or administrative configurations.
The operational impact of this vulnerability is severe due to its remote exploitability. An adversary does not need local access or authentication privileges on the target server to initiate an attack. By crafting specific HTTP requests with manipulated fid or id parameters, a threat actor can extract data from the database through standard web traffic. The availability of public exploits significantly lowers the barrier for entry, enabling less sophisticated attackers to compromise systems running this software version. Given that the product utilizes a rolling release model for continuous delivery, there are no discrete version numbers associated with affected releases or patched updates. This dynamic update structure complicates vulnerability management and patch deployment processes, as administrators cannot rely on static version checks to determine exposure status.
From an industry standards perspective, this issue aligns closely with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command. The attack vector corresponds to ATT&CK technique T1059, specifically command scripting or database query injection methods that allow for data exfiltration and potential system compromise. The lack of response from the project maintainers despite early notification via issue reports leaves users with limited official mitigation options beyond immediate remediation strategies such as input validation on client-side applications if feasible, though server-side fixes are required for true resolution. Organizations currently deploying this file management system should consider isolating affected instances behind web application firewalls that can detect and block SQL injection patterns until a verified patch is released by the development team or migrating to alternative solutions with active security maintenance cycles.