---
id: "CVE-2026-114256"
kind: "vulnerability"
aliases: ["CVE-2026-114256"]
title: "oretnom23 file-management-system-php: SQL injection in folder and file handlers"
severity: "high"
cvss: 7.5
epss: 0.00275
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["file-management", "other", "php", "self-hosted"]
not_affected_if: ["not-this-project"]
published_at: "2026-10-21T16:17:32+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:16:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114256", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114256", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# oretnom23 file-management-system-php: SQL injection in folder and file handlers

The file-management-system-php project has SQL injection in its folder and file management functions in admin_class.php, reachable through the name, parent_id, id, type, folder_id and description arguments. A remote attacker can read or change the application's database, and the exploit is public.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application runs oretnom23 file-management-system-php by looking for admin_class.php with a save_folder function in the project tree
- Compare the deployed commit against 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4; the project has no release versions, so the commit hash is the only reference
- unknown for any other check, the sources do not say

## Fix

- unknown: the sources report no fixed release, and the project has not responded to the report
- Until a fix exists, restrict access to the admin area and the folder/file endpoints at the network or web server layer

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114256
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114256

## From the sources

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_