{"id":"CVE-2026-114257","kind":"vulnerability","aliases":["CVE-2026-114257"],"related":[],"title":"oretnom23 file-management-system-php: SQL injection in download.php via ID","description":"A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The file download script download.php passes the ID argument into a SQL query without sanitizing it, so a remote attacker can inject SQL. The exploit is public, and the project has not responded to the report.","severity":"high","cvss":7.5,"epss":0.00328,"exploited":false,"exploited_at":null,"products":[{"name":"file-management-system-php","fixed":[],"affected":"<= 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 (rolling release)","ecosystem":"other"}],"ecosystems":[],"tags":["file-management","no-fix","other","php","rolling-release","self-hosted","sql-injection","unauthenticated"],"not_affected_if":["download-php-blocked","download-php-removed","not-deployed"],"how_to_check":"- Look for download.php in the deployment: grep -n 'where id=' download.php. If it has $conn->query(\"SELECT * FROM files where id=\".$_GET['id']) it is vulnerable.\n- Compare your checkout with commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 (git log); no later fixed commit is known.\n- Check web logs for download.php?id= values containing 'union' or 'select'.","fix":"No fix: the project has not responded and has no patched commit or release. Remove or block public access to download.php, or patch it yourself: cast id to int or use a prepared statement, and require login. Consider replacing the app.","status":"open","published_at":"2026-10-21T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:40+00:00","updated_at":"2026-10-25T03:23:43+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:16:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"oretnom23 file-management-system-php: SQL injection in download.php via ID","impact":"medium","summary":"The file download script download.php passes the ID argument into a SQL query without sanitizing it, so a remote attacker can inject SQL. The exploit is public, and the project has not responded to the report.","category":"other","nicknames":[],"who_cares":["php","self-hosted","file-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters database contents through the download endpoint","analyst_note":"Confirm the fix status and any patched commit at https://nvd.nist.gov/vuln/detail/CVE-2026-114257, since the project has not responded and no fixed version is listed.","how_to_check":"- Check whether the deployment includes download.php from oretnom23 file-management-system-php, for example with `grep -n \"readfile\" download.php`\n- Compare the repository commit against `2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4` (the last affected commit per the description)","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Sites that run the oretnom23 file-management-system-php PHP application up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 are exposed, because the download endpoint reachable from the internet builds SQL from the ID parameter. The sources do not name a patched release, and the project is a rolling release. Teams that do not run this application can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":3449,"output_tokens":579,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fix status and any patched commit at https://nvd.nist.gov/vuln/detail/CVE-2026-114257, since the project has not responded and no fixed version is listed.","search":"'-114257':15A,18A '-2026':14A,17A '2e3':93C 'affect':95C,155C 'argument':50B,116C 'attack':61B,123C 'c1ebe60f121e8df4fb3f544f0e9591d9a01e4':94C 'compon':109C 'continu':147C 'cve':13A,16A 'deliveri':148C 'detect':83C 'disclos':133C,161C 'download':44B,111C 'download.php':10A,46B,106C 'earli':169C 'exploit':66B,130C 'file':3A,20A,25B,43B,87C,105C,110C 'file-manag':24B 'file-management-system-php':2A,19A,86C 'fix':29B 'function':101C 'host':37B 'id':12A,49B,117C 'inform':153C,165C 'inject':8A,40B,63B,121C 'issu':172C 'lead':118C 'manag':4A,26B,88C 'management':21A 'manipul':113C 'may':124C,136C 'no-fix':27B 'oretnom23':1A,85C 'pass':47B 'perform':126C 'php':6A,23A,31B,90C 'problem':168C 'product':140C 'project':71B,163C 'public':68B,134C 'queri':54B 'readfil':102C 'releas':34B,144C,158C 'remot':60B,128C 'report':77B,173C 'respond':74B,177C 'roll':33B,143C 'rolling-releas':32B 'sanit':56B 'script':45B 'secur':79C 'self':36B 'self-host':35B 'sql':7A,39B,53B,64B,120C 'sql-inject':38B 'system':5A,22A,89C,145C 'unauthent':41B 'updat':157C 'use':138C 'util':141C 'version':152C 'via':11A 'vulner':80C,98C 'without':55B 'yet':178C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the oretnom23 file-management-system-php app (commit 2e3c1ebe or later; no fixed version exists) with download.php reachable. No login is needed: the id GET parameter goes straight into SQL, and a UNION SELECT can set file_path so the server returns any file the web user can read (for example db_connect.php with database credentials) and database contents. Teams not running this app can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114257","severity":null,"published_at":"2026-10-21T16:17:33+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114257","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114257","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114257:705","url":null,"severity":null,"published_at":"2026-10-25T03:23:43+00:00","modified_at":"2026-10-25T03:23:43+00:00","first_seen_at":"2026-10-25T03:23:43+00:00","fetched_at":"2026-10-25T03:23:43+00:00","note":"No maintainer advisory or fix exists; issue #5 (reporter, open since 2026-10-07, no reply) has the code and PoC; VulDB and NVD confirm rolling release with no patched version. Unauthenticated, also allows arbitrary file read via UNION on file_path. Not marked verified: no vendor words."}],"documents":[{"id":3145,"url":"https://github.com/oretnom23/file-management-system-php/issues/5","title":"Unauthenticated SQL injection in download.php (issue #5, with PoC)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3146,"url":"https://vuldb.com/vuln/424689","title":"VulDB VDB-424689","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3147,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114257","title":"NVD CVE-2026-114257","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}