{"id":"CVE-2026-114258","kind":"vulnerability","aliases":["CVE-2026-114258"],"related":[],"title":"File Management System PHP: SQL injection in files.php lets remote attackers query data","description":"A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The oretnom23 file-management-system-php project has an SQL injection flaw in files.php, where the fid or id argument is passed into database queries unsafely. A remote attacker can read or change database contents, and a public exploit exists.","severity":"high","cvss":7.5,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-management","package","php","self-hosted","sql"],"not_affected_if":["no-internet-access","not-deployed"],"how_to_check":"- Check whether the application runs `file-management-system-php` from oretnom23 by looking for files.php under a File Management component in the deployed codebase\n- Compare the deployed commit against `2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4`, which the sources list as the last affected version\n- Review files.php for fid or id values concatenated into SQL statements instead of bound parameters","fix":"- No patched release exists: the project uses a rolling release and has not responded to the report, so unknown\n- Remove or restrict public access to the application until a fix is confirmed\n- Replace raw SQL in files.php with prepared statements that bind the fid and id parameters","status":"open","published_at":"2026-10-21T17:18:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:37+00:00","updated_at":"2026-10-25T03:16:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:16:37Z","model":"claude-haiku-5-5","output":{"fix":"- No patched release exists: the project uses a rolling release and has not responded to the report, so unknown\n- Remove or restrict public access to the application until a fix is confirmed\n- Replace raw SQL in files.php with prepared statements that bind the fid and id parameters","reach":"internet","title":"File Management System PHP: SQL injection in files.php lets remote attackers query data","impact":"high","summary":"The oretnom23 file-management-system-php project has an SQL injection flaw in files.php, where the fid or id argument is passed into database queries unsafely. A remote attacker can read or change database contents, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["php","self-hosted","sql","file-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker reads or modifies database contents through injected SQL","analyst_note":"Confirm whether any fixed version or mitigation exists; the sources say the project has not responded and give no version range, so check the NVD entry and the project repository for updates.","how_to_check":"- Check whether the application runs `file-management-system-php` from oretnom23 by looking for files.php under a File Management component in the deployed codebase\n- Compare the deployed commit against `2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4`, which the sources list as the last affected version\n- Review files.php for fid or id values concatenated into SQL statements instead of bound parameters","needs_analyst":true,"not_affected_if":["not-deployed","no-internet-access"],"who_is_affected":"Teams that deploy the oretnom23 file-management-system-php application with files.php reachable from the network are exposed, since the flaw is triggered through the fid or id argument. Teams that do not run this project, or that only use it on a closed internal network with no remote access, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":3473,"output_tokens":668,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114258':16A,19A '-2026':15A,18A '2e3':83C 'affect':85C,146C 'argument':49B,107C 'attack':11A,58B,119C 'avail':151C 'c1ebe60f121e8df4fb3f544f0e9591d9a01e4':84C 'chang':62B 'compon':99C 'content':64B 'contini':139C 'cve':14A,17A 'data':13A 'databas':53B,63B 'deliveri':140C 'detail':144C 'detect':73C 'earli':159C 'exist':69B 'exploit':68B,122C 'fid':46B 'fid/id':108C 'file':1A,21B,32B,77C,95C,100C 'file-manag':20B 'file-management-system-php':31B,76C 'files.php':8A,43B,96C 'flaw':41B 'function':92C 'host':27B 'id':48B 'inform':155C 'initi':117C 'inject':6A,40B,112C 'issu':88C,162C 'let':9A 'manag':2A,22B,33B,78C,101C 'manipul':104C 'may':127C 'oretnom23':30B,75C 'packag':23B 'pass':51B 'perform':102C 'php':4A,24B,35B,80C 'possibl':115C 'problem':158C 'product':131C 'project':36B,153C 'provid':138C 'public':67B,125C 'queri':12A,54B 'read':60B 'releas':136C,149C 'remot':10A,57B,120C 'report':163C 'respond':167C 'result':109C 'roll':135C 'self':26B 'self-host':25B 'sql':5A,28B,39B,111C 'system':3A,34B,79C 'therefor':141C 'unknown':91C 'unsaf':55B 'updat':148C 'use':129C,133C 'version':143C 'vulner':71C 'yet':168C","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy the oretnom23 file-management-system-php application with files.php reachable from the network are exposed, since the flaw is triggered through the fid or id argument. Teams that do not run this project, or that only use it on a closed internal network with no remote access, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114258","severity":null,"published_at":"2026-10-21T17:18:25+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114258","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114258","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}