{"id":"CVE-2026-114259","kind":"vulnerability","aliases":["CVE-2026-114259"],"related":[],"title":"oretnom23 file-management-system-php: unrestricted file upload via save_files","description":"A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"save_files in admin_class.php (reached via ajax.php?action=save_files) writes the uploaded file with its original name and extension into the web-accessible assets/uploads/ folder with no type check. ajax.php does not check for a login, so an unauthenticated visitor can upload a .php file and run it, which gives code execution on the server. The reporter's issue contains a working PoC. The maintainer has not responded and no fix exists.","severity":"critical","cvss":7.5,"epss":0.00301,"exploited":false,"exploited_at":null,"products":[{"name":"file-management-system-php","fixed":[],"affected":"<= 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4","ecosystem":"other"}],"ecosystems":[],"tags":["file-management","other","php","public-poc","rce","self-hosted","unauthenticated"],"not_affected_if":["auth-in-front","not-deployed","uploads-dir-not-executable"],"how_to_check":"- In admin_class.php, look at save_files(): if it calls move_uploaded_file into 'assets/uploads/' without an extension allowlist, you are affected.\n- In ajax.php, check whether the save_files action runs without a session check.\n- Look in assets/uploads/ for .php, .phtml or .phar files and for unexpected recent uploads; check web logs for POSTs to ajax.php?action=save_files from unknown IPs.\n- Affected: commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier (rolling release, no version numbers).","fix":"No fix or fixed commit as of 2026-10-25; the maintainer has not responded to issue #7. Remove the app from the internet or put it behind authentication (VPN, HTTP basic auth). Block script execution in assets/uploads/ (for Apache, 'php_flag engine off' or RemoveHandler .php; for nginx, deny .php in that location). Patch save_files to require a session and allow only specific extensions.","status":"open","published_at":"2026-10-21T17:18:26+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:36+00:00","updated_at":"2026-10-25T03:22:46+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:16:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"oretnom23 file-management-system-php: unrestricted file upload via save_files","impact":"high","summary":"The save_files function in admin_class.php of oretnom23 file-management-system-php does not restrict uploaded files, as reported in the description. A remote attacker can upload arbitrary files through the Upload argument, and the exploit is public.","category":"other","nicknames":[],"who_cares":["php","self-hosted","file-management"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker uploads files to the server, possibly executing code","analyst_note":"Find out whether the upload endpoint requires login and whether uploaded files are executable; check the NVD and EPSS entries and look for a fixed commit or a maintainer response.","how_to_check":"- Check whether the project is deployed: look for `admin_class.php` with a `save_files` function in the application source.\n- Confirm the code is from the affected commit `2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4` or earlier; version details are unknown because the project uses rolling releases.","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Teams running the oretnom23 file-management-system-php application with the save_files upload handler in admin_class.php reachable over the network. Sources do not say whether a login is required or whether the upload path is exposed by default. Teams that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000617,"input_tokens":3465,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find out whether the upload endpoint requires login and whether uploaded files are executable; check the NVD and EPSS entries and look for a fixed commit or a maintainer response.","search":"'-114259':15A,18A '-2026':14A,17A '2e3':125C 'access':61B 'action':44B 'admin_class.php':40B,136C 'affect':128C,182C 'ajax.php':43B,68B 'approach':170C 'argument':142C 'assets/uploads':62B 'attack':155C 'avail':188C 'c1ebe60f121e8df4fb3f544f0e9591d9a01e4':126C 'check':67B,71B 'code':89B 'contain':98B 'contini':176C 'cve':13A,16A 'deliveri':177C 'detail':180C 'earli':196C 'execut':90B,137C 'exist':110B 'exploit':158C 'extens':56B 'file':3A,8A,12A,20A,25B,38B,46B,50B,83B,119C,132C,135C 'file-manag':24B 'file-management-system-php':2A,19A,118C 'fix':109B 'flaw':112C 'folder':63B 'found':115C 'function':130C 'give':88B 'host':35B 'inform':192C 'issu':97B,199C 'launch':153C 'lead':145C 'login':74B 'maintain':103B 'manag':4A,26B,120C 'management':21A 'manipul':139C 'may':163C 'name':54B 'oretnom23':1A,117C 'origin':53B 'php':6A,23A,28B,82B,122C 'poc':31B,101B 'possibl':151C 'problem':195C 'product':167C 'project':190C 'provid':175C 'public':30B 'public-poc':29B 'publish':161C 'rce':32B 'reach':41B 'releas':173C,185C 'remot':156C 'report':95B,200C 'respond':106B,204C 'roll':172C 'run':85B 'save':11A,37B,45B,131C 'self':34B 'self-host':33B 'server':93B 'system':5A,22A,121C 'take':168C 'therefor':178C 'type':66B 'unauthent':36B,77B 'unrestrict':7A,147C 'updat':184C 'upload':9A,49B,80B,143C,148C 'use':165C 'version':179C 'via':10A,42B 'visitor':78B 'web':60B 'web-access':59B 'work':100B 'write':47B 'yet':205C","nicknames":[],"mitigations":[],"who_affected":"Teams running the oretnom23 file-management-system-php application with the save_files upload handler in admin_class.php reachable over the network. Sources do not say whether a login is required or whether the upload path is exposed by default. Teams that do not run this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114259","severity":null,"published_at":"2026-10-21T17:18:26+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114259","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114259","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114259:703","url":null,"severity":null,"published_at":"2026-10-25T03:22:46+00:00","modified_at":"2026-10-25T03:22:46+00:00","first_seen_at":"2026-10-25T03:22:46+00:00","fetched_at":"2026-10-25T03:22:46+00:00","note":"Reporter's issue #7 (not maintainer) shows ajax.php?action=save_files has no session check, so upload is unauthenticated; file saved with original extension in web-accessible assets/uploads/ as <minute-timestamp>_<name>, so a .php upload executes (RCE). Maintainer has not responded, no fix; no in-the-wild exploitation seen. VulDB's 'admin privileges' analysis contradicts the issue, so I ignored it. Nothing marked verified (no vendor source). Severity raised to critical: unauthenticated RCE with public PoC, but only for a small hobby project."}],"documents":[{"id":3137,"url":"https://github.com/oretnom23/file-management-system-php/issues/7","title":"Unrestricted file upload in save_files() allows remote code execution (issue #7)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3138,"url":"https://vuldb.com/submit/1018611","title":"VulDB Submit #1018611","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3139,"url":"https://vuldb.com/cve/CVE-2026-114259","title":"VulDB CVE-2026-114259","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}