{"id":"CVE-2026-111652","kind":"vulnerability","aliases":["CVE-2026-111652"],"related":[],"title":"EngineerCMS: unauthenticated download of project image and video attachments","description":"Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.","summary":"EngineerCMS through 2.0.5 serves project image and video attachments from the /attachment/* path without running its authorization checks. An unauthenticated attacker who knows or guesses a file path can download those .jpg, .png, .bmp, or .mp4 files.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["engineercms","package","php","self-hosted"],"not_affected_if":["not-engineercms","patched-version"],"how_to_check":"- Check the installed EngineerCMS version and confirm it is above `2.0.5`.\n- Request a known attachment path such as `/attachment/<file>.jpg` without logging in and see whether the file is returned.","fix":"- Upgrade EngineerCMS to a version later than `2.0.5` if the sources name a fixed release; otherwise unknown.\n- Until patched, restrict the /attachment/* path at the web server or proxy so it requires an authenticated session.","status":"open","published_at":"2026-10-16T18:17:46+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:26+00:00","updated_at":"2026-10-25T03:42:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade EngineerCMS to a version later than `2.0.5` if the sources name a fixed release; otherwise unknown.\n- Until patched, restrict the /attachment/* path at the web server or proxy so it requires an authenticated session.","reach":"internet","title":"EngineerCMS: unauthenticated download of project image and video attachments","impact":"low","summary":"EngineerCMS through 2.0.5 serves project image and video attachments from the /attachment/* path without running its authorization checks. An unauthenticated attacker who knows or guesses a file path can download those .jpg, .png, .bmp, or .mp4 files.","category":"package","nicknames":[],"who_cares":["engineercms","self-hosted","php"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated users can download project images and videos stored as attachments.","analyst_note":"Confirm the fixed version and whether an upstream patch or advisory exists at the NVD entry, since the sources give no fix version.","how_to_check":"- Check the installed EngineerCMS version and confirm it is above `2.0.5`.\n- Request a known attachment path such as `/attachment/<file>.jpg` without logging in and see whether the file is returned.","needs_analyst":true,"not_affected_if":["not-engineercms","patched-version"],"who_is_affected":"Teams running EngineerCMS 2.0.5 or earlier that store project images or videos as attachments under the /attachment/ path. Instances where that path is already behind a login at the proxy layer are less exposed, but the sources do not confirm this. Teams that do not run EngineerCMS can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000636,"input_tokens":3335,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111652':12A,15A '-2026':11A,14A '/attachment':33B,86C '2.0.5':24B,61C 'admin':102C 'allow':70C 'attach':9A,30B,79C 'attachcontroller.attachment':68C 'attack':42B,72C,80C 'author':38B,65C 'bmp':55B,91C 'casbin':99C 'check':39B,103C 'contain':62C 'cve':10A,13A 'deriv':85C 'download':3A,51B,74C 'engineercm':1A,16B,22B,59C 'file':48B,58B,94C 'guess':46B 'host':21B 'imag':6A,27B,76C 'jpg':53B,89C 'know':44B 'known':83C 'miss':64C 'mp4':57B,93C 'owner':100C 'packag':17B 'path':34B,49B,87C 'php':18B 'png':54B,90C 'project':5A,26B,75C 'request':82C 'run':36B 'self':20B 'self-host':19B 'serv':25B,97C 'unauthent':2A,41B,71C 'video':8A,29B,78C 'vulner':66C 'without':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running EngineerCMS 2.0.5 or earlier that store project images or videos as attachments under the /attachment/ path. Instances where that path is already behind a login at the proxy layer are less exposed, but the sources do not confirm this. Teams that do not run EngineerCMS can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111652","severity":null,"published_at":"2026-10-16T18:17:46+00:00","modified_at":"2026-10-16T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}