---
id: "CVE-2026-114259"
kind: "vulnerability"
aliases: ["CVE-2026-114259"]
title: "oretnom23 file-management-system-php: unrestricted file upload via save_files"
severity: "critical"
cvss: 7.5
epss: 0.00301
exploited: false
status: "open"
category: "other"
products: [{"name": "file-management-system-php", "fixed": [], "affected": "<= 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4", "ecosystem": "other"}]
ecosystems: []
tags: ["file-management", "other", "php", "public-poc", "rce", "self-hosted", "unauthenticated"]
not_affected_if: ["auth-in-front", "not-deployed", "uploads-dir-not-executable"]
published_at: "2026-10-21T17:18:26+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:22:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114259", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114259", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:22:46+00:00"}]
---

# oretnom23 file-management-system-php: unrestricted file upload via save_files

save_files in admin_class.php (reached via ajax.php?action=save_files) writes the uploaded file with its original name and extension into the web-accessible assets/uploads/ folder with no type check. ajax.php does not check for a login, so an unauthenticated visitor can upload a .php file and run it, which gives code execution on the server. The reporter's issue contains a working PoC. The maintainer has not responded and no fix exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:file-management-system-php affected <= 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 fixed ?

## How to check

- In admin_class.php, look at save_files(): if it calls move_uploaded_file into 'assets/uploads/' without an extension allowlist, you are affected.
- In ajax.php, check whether the save_files action runs without a session check.
- Look in assets/uploads/ for .php, .phtml or .phar files and for unexpected recent uploads; check web logs for POSTs to ajax.php?action=save_files from unknown IPs.
- Affected: commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier (rolling release, no version numbers).

## Fix

No fix or fixed commit as of 2026-10-25; the maintainer has not responded to issue #7. Remove the app from the internet or put it behind authentication (VPN, HTTP basic auth). Block script execution in assets/uploads/ (for Apache, 'php_flag engine off' or RemoveHandler .php; for nginx, deny .php in that location). Patch save_files to require a session and allow only specific extensions.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114259
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114259
- 2026-10-25T03:22:46+00:00 analyst — Reporter's issue #7 (not maintainer) shows ajax.php?action=save_files has no session check, so upload is unauthenticated; file saved with original extension in web-accessible assets/uploads/ as <minute-timestamp>_<name>, so a .php upload executes (RCE). Maintainer has not responded, no fix; no in-the-wild exploitation seen. VulDB's 'admin privileges' analysis contradicts the issue, so I ignored it. Nothing marked verified (no vendor source). Severity raised to critical: unauthenticated RCE with public PoC, but only for a small hobby project.

## Documents

- [advisory] VulDB CVE-2026-114259 https://vuldb.com/cve/CVE-2026-114259
- [describes] VulDB Submit #1018611 https://vuldb.com/submit/1018611
- [poc] Unrestricted file upload in save_files() allows remote code execution (issue #7) https://github.com/oretnom23/file-management-system-php/issues/7

## From the sources

A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_