---
id: "CVE-2026-114258"
kind: "vulnerability"
aliases: ["CVE-2026-114258"]
title: "File Management System PHP: SQL injection in files.php lets remote attackers query data"
severity: "high"
cvss: 7.5
epss: 0.00343
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["file-management", "package", "php", "self-hosted", "sql"]
not_affected_if: ["no-internet-access", "not-deployed"]
published_at: "2026-10-21T17:18:25+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:16:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114258", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114258", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# File Management System PHP: SQL injection in files.php lets remote attackers query data

The oretnom23 file-management-system-php project has an SQL injection flaw in files.php, where the fid or id argument is passed into database queries unsafely. A remote attacker can read or change database contents, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application runs `file-management-system-php` from oretnom23 by looking for files.php under a File Management component in the deployed codebase
- Compare the deployed commit against `2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4`, which the sources list as the last affected version
- Review files.php for fid or id values concatenated into SQL statements instead of bound parameters

## Fix

- No patched release exists: the project uses a rolling release and has not responded to the report, so unknown
- Remove or restrict public access to the application until a fix is confirmed
- Replace raw SQL in files.php with prepared statements that bind the fid and id parameters

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114258
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114258

## From the sources

A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_