---
id: "CVE-2026-114255"
kind: "vulnerability"
aliases: ["CVE-2026-114255"]
title: "oretnom23 file-management-system-php: SQL injection in user account save function"
severity: "high"
cvss: 7.5
epss: 0.00275
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "self-hosted"]
not_affected_if: ["not-deployed"]
published_at: "2026-10-21T16:17:32+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:16:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114255", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114255", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# oretnom23 file-management-system-php: SQL injection in user account save function

The save_user function in admin_class.php of the User Account Management component fails to sanitize the name, username, password, type and id parameters, allowing SQL injection. A remote attacker can read or change database contents, and the exploit is public.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project is deployed by searching the codebase for `admin_class.php` and confirming `save_user` builds SQL from request parameters
- Confirm the deployed commit: unknown

## Fix

- unknown: the project is a rolling release with no fixed version and the maintainer has not responded
- Until a patch exists, use prepared statements for the save_user queries in admin_class.php or restrict access to the admin user-management pages

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114255
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114255

## From the sources

A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_