Live › vulnerability › CVE-2026-114261
Go to dashboardMomoTommy/file-management-system (a Laravel app) registers its /api/files resource without auth:sanctum, so anyone who can reach it can list, upload, rename and delete files with no login. A public PoC is in the project's issue tracker; the maintainer has not responded and no fix exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the MomoTommy file-management-system code from the affected commit (dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) with the Files API reachable over the network. The project does not use versioning, so affected releases are unknown. Deployments that keep the Files API behind a working login or are not exposed to the network are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| MomoTommy/file-management-system | github | commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning) | – |
files, FileController::class) in Route::middleware(auth:sanctum)->group(...) in routes/api.php, add authorization/ownership checks in FileController, or block /api/files at the web server until thenEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114261")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.