---
id: "CVE-2026-111619"
kind: "vulnerability"
aliases: ["CVE-2026-111619"]
title: "FilePress: SQL injection via asc parameter leaks admin credential hashes"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "FilePress", "fixed": [], "affected": "<= 3.0.1", "ecosystem": "php"}]
ecosystems: []
tags: ["authenticated", "dzzoffice", "filepress", "package", "php", "pichome", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "no-self-registration", "no-user-accounts", "not-deployed"]
published_at: "2026-10-16T18:17:41+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:46:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111619", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:46:52+00:00"}]
---

# FilePress: SQL injection via asc parameter leaks admin credential hashes

FilePress <= 3.0.1 concatenates the unvalidated asc GET parameter into ORDER BY in two file-list handlers; any logged-in library member can run blind boolean/time-based SQL to read other users' and admin credential hashes. No fixed release exists; no known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- php:FilePress affected <= 3.0.1 fixed ?

## How to check

1) Check FilePress version (<= 3.0.1 affected; no fixed version exists). 2) In dzz/pichome/library/filelist.php (~line 93) and dzz/collection/filelist.php (~line 56), see if $asc is only trim()'d and not restricted to asc/desc. 3) Grep web logs for mod=pichome&op=library&do=filelist or collection filelist requests with asc values containing select, case, if, sleep, benchmark, ascii, mid. 4) Check whether open registration is on: any registered library member can reach it.

## Fix

No patched version published as of 2026-10-25; latest release 3.0.1 is affected. Interim: patch both files so asc is whitelisted to 'asc'/'desc' (e.g. in dzz/pichome/library/filelist.php and dzz/collection/filelist.php); upgrade once the vendor ships a release.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111619
- 2026-10-25T03:46:52+00:00 analyst — No fixed release found: 3.0.1 (Jul) is latest on GitHub releases; CVE/VulnCheck say affected 0 through 3.0.1; reporter write-up is static review only, no PoC, not exploited. CVSS 4.0 7.1 / 3.1 6.5 (AV:N/PR:L). Related: unpatched pre-auth SQLi issue #70 (order param, shares) and CVE-2026-90879 in same product. Nothing marked verified (no vendor words).

## Documents

- [advisory] FilePress authenticated ORDER BY SQL injection (reporter write-up) https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqli
- [advisory] VulnCheck: FilePress through 3.0.1 SQLi via asc https://www.vulncheck.com/advisories/filepress-through-3.0.1-sql-injection-via-asc-parameter-in-filelist-php
- [mentions] FilePress releases (latest 3.0.1) https://github.com/zyx0814/FilePress/releases

## From the sources

FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_