---
id: "CVE-2026-114257"
kind: "vulnerability"
aliases: ["CVE-2026-114257"]
title: "oretnom23 file-management-system-php: SQL injection in download.php via ID"
severity: "high"
cvss: 7.5
epss: 0.00328
exploited: false
status: "open"
category: "other"
products: [{"name": "file-management-system-php", "fixed": [], "affected": "<= 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 (rolling release)", "ecosystem": "other"}]
ecosystems: []
tags: ["file-management", "no-fix", "other", "php", "rolling-release", "self-hosted", "sql-injection", "unauthenticated"]
not_affected_if: ["download-php-blocked", "download-php-removed", "not-deployed"]
published_at: "2026-10-21T16:17:33+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:23:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114257", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114257", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:23:43+00:00"}]
---

# oretnom23 file-management-system-php: SQL injection in download.php via ID

The file download script download.php passes the ID argument into a SQL query without sanitizing it, so a remote attacker can inject SQL. The exploit is public, and the project has not responded to the report.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:file-management-system-php affected <= 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 (rolling release) fixed ?

## How to check

- Look for download.php in the deployment: grep -n 'where id=' download.php. If it has $conn->query("SELECT * FROM files where id=".$_GET['id']) it is vulnerable.
- Compare your checkout with commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 (git log); no later fixed commit is known.
- Check web logs for download.php?id= values containing 'union' or 'select'.

## Fix

No fix: the project has not responded and has no patched commit or release. Remove or block public access to download.php, or patch it yourself: cast id to int or use a prepared statement, and require login. Consider replacing the app.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114257
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114257
- 2026-10-25T03:23:43+00:00 analyst — No maintainer advisory or fix exists; issue #5 (reporter, open since 2026-10-07, no reply) has the code and PoC; VulDB and NVD confirm rolling release with no patched version. Unauthenticated, also allows arbitrary file read via UNION on file_path. Not marked verified: no vendor words.

## Documents

- [advisory] VulDB VDB-424689 https://vuldb.com/vuln/424689
- [mentions] NVD CVE-2026-114257 https://nvd.nist.gov/vuln/detail/CVE-2026-114257
- [poc] Unauthenticated SQL injection in download.php (issue #5, with PoC) https://github.com/oretnom23/file-management-system-php/issues/5

## From the sources

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_