{"id":"CVE-2026-114256","kind":"vulnerability","aliases":["CVE-2026-114256"],"related":[],"title":"oretnom23 file-management-system-php: SQL injection in folder and file handlers","description":"A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The file-management-system-php project has SQL injection in its folder and file management functions in admin_class.php, reachable through the name, parent_id, id, type, folder_id and description arguments. A remote attacker can read or change the application's database, and the exploit is public.","severity":"high","cvss":7.5,"epss":0.00275,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-management","other","php","self-hosted"],"not_affected_if":["not-this-project"],"how_to_check":"- Check whether the application runs oretnom23 file-management-system-php by looking for admin_class.php with a save_folder function in the project tree\n- Compare the deployed commit against 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4; the project has no release versions, so the commit hash is the only reference\n- unknown for any other check, the sources do not say","fix":"- unknown: the sources report no fixed release, and the project has not responded to the report\n- Until a fix exists, restrict access to the admin area and the folder/file endpoints at the network or web server layer","status":"open","published_at":"2026-10-21T16:17:32+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:42+00:00","updated_at":"2026-10-25T03:16:42+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:16:42Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report no fixed release, and the project has not responded to the report\n- Until a fix exists, restrict access to the admin area and the folder/file endpoints at the network or web server layer","reach":"internet","title":"oretnom23 file-management-system-php: SQL injection in folder and file handlers","impact":"high","summary":"The file-management-system-php project has SQL injection in its folder and file management functions in admin_class.php, reachable through the name, parent_id, id, type, folder_id and description arguments. A remote attacker can read or change the application's database, and the exploit is public.","category":"other","nicknames":[],"who_cares":["php","self-hosted","file-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the application database over the network","analyst_note":"Check the NVD entry and the linked issue report for whether authentication is required and whether any fixed commit exists; the project is unresponsive, so a mitigation guide may be needed.","how_to_check":"- Check whether the application runs oretnom23 file-management-system-php by looking for admin_class.php with a save_folder function in the project tree\n- Compare the deployed commit against 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4; the project has no release versions, so the commit hash is the only reference\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["not-this-project"],"who_is_affected":"Any deployment of oretnom23 file-management-system-php at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 is exposed, since the flawed functions take user-supplied input directly into SQL queries. Systems that do not run this project can skip it. Whether a login is needed to reach the vulnerable functions is not stated in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":3517,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114256':16A,19A '-2026':15A,18A '2e3':90C 'admin_class.php':46B,101C 'adopt':142C 'affect':92C,155C 'applic':68B 'argument':59B,111C 'attack':62B,117C,139C 'avail':130C 'c1ebe60f121e8df4fb3f544f0e9591d9a01e4':91C 'cannot':159C 'carri':122C 'caus':113C 'chang':66B 'compon':104C 'continu':149C 'could':135C 'cve':14A,17A 'databas':70B 'deliveri':150C 'descript':58B 'detail':153C 'earli':169C 'exploit':73B,126C 'file':3A,12A,21B,30B,42B,84C,100C 'file-manag':20B 'file-management-system-php':2A,29B,83C 'folder':10A,40B,55B,105C 'folder/delete_folder/delete_file/file_rename/save_files':97C 'function':44B,95C 'handler':13A 'host':27B 'id':52B,53B,56B 'identifi':80C 'inform':165C 'inject':8A,37B,115C 'issu':172C 'made':129C 'maintain':148C 'manag':4A,22B,31B,43B,85C,106C 'manipul':108C 'name':50B 'name/parent_id/id/type/folder_id/description':112C 'oretnom23':1A,82C 'parent':51B 'php':6A,24B,33B,87C 'possibl':119C 'problem':168C 'product':141C 'project':34B,163C 'public':75B,133C 'reachabl':47B 'read':64B 'releas':145C,158C 'remot':61B,124C 'report':173C 'respond':177C 'roll':144C 'save':96C 'self':26B 'self-host':25B 'specifi':161C 'sql':7A,36B,114C 'strategi':146C 'system':5A,32B,86C 'therefor':151C 'type':54B 'updat':157C 'use':137C 'version':152C 'weak':77C 'yet':178C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of oretnom23 file-management-system-php at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 is exposed, since the flawed functions take user-supplied input directly into SQL queries. Systems that do not run this project can skip it. Whether a login is needed to reach the vulnerable functions is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114256","severity":null,"published_at":"2026-10-21T16:17:32+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114256","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114256","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}