---
id: "CVE-2026-114261"
kind: "vulnerability"
aliases: ["CVE-2026-114261"]
title: "MomoTommy file-management-system: Files API lacks authentication, remote file access"
severity: "high"
cvss: 7.5
epss: 0.00514
exploited: false
status: "open"
category: "package"
products: [{"name": "MomoTommy/file-management-system", "fixed": [], "affected": "commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning)", "ecosystem": "github"}]
ecosystems: []
tags: ["file-management", "laravel", "no-fix", "package", "php", "self-hosted"]
not_affected_if: ["auth-middleware-added", "auth-required", "not-exposed-to-network"]
published_at: "2026-10-21T17:18:26+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:22:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114261", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114261", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:22:50+00:00"}]
---

# MomoTommy file-management-system: Files API lacks authentication, remote file access

MomoTommy/file-management-system (a Laravel app) registers its /api/files resource without auth:sanctum, so anyone who can reach it can list, upload, rename and delete files with no login. A public PoC is in the project's issue tracker; the maintainer has not responded and no fix exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:MomoTommy/file-management-system affected commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning) fixed ?

## How to check

- In routes/api.php, check whether Route::apiResource('files', FileController::class) sits outside an auth:sanctum middleware group (run: php artisan route:list --path=api/files and look for no auth middleware).
- From outside, run: curl -i http://HOST/api/files . A 200 with JSON means exposed; 401 means protected.

## Fix

No fixed version or commit exists; project is unresponsive. Workaround: wrap Route::apiResource('files', FileController::class) in Route::middleware('auth:sanctum')->group(...) in routes/api.php, add authorization/ownership checks in FileController, or block /api/files at the web server until then.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114261
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114261
- 2026-10-25T03:22:50+00:00 analyst — No fix: repo has only the initial commit dc9ce1b, issue #1 (2026-10-07) open with curl repro (public PoC); root cause is routes/api.php registering Route::apiResource('files') without auth:sanctum. NVD page unreadable; confirmed via CVE.org/VulDB. Sibling CVE-2026-114262 (issue #2, upload) is same repo.

## Documents

- [advisory] VulDB 424693 https://vuldb.com/vuln/424693
- [describes] Commit history: only initial commit dc9ce1b https://github.com/MomoTommy/file-management-system/commits/main
- [poc] Issue #1: Missing authentication on /api/files https://github.com/MomoTommy/file-management-system/issues/1

## From the sources

A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_