Live › vulnerability › CVE-2026-111652
Go to dashboardEngineerCMS through 2.0.5 serves project image and video attachments from the /attachment/* path without running its authorization checks. An unauthenticated attacker who knows or guesses a file path can download those .jpg, .png, .bmp, or .mp4 files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running EngineerCMS 2.0.5 or earlier that store project images or videos as attachments under the /attachment/ path. Instances where that path is already behind a login at the proxy layer are less exposed, but the sources do not confirm this. Teams that do not run EngineerCMS can skip it.
No product ranges from the sources yet.
2.0.5./attachment/<file>.jpg without logging in and see whether the file is returned.2.0.5 if the sources name a fixed release; otherwise unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-111652")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.