Live › vulnerability › CVE-2026-114262
Go to dashboardMomoTommy/file-management-system (Laravel) FileController::store() accepts any file type up to 10 MB with no login, saves it to the public disk keeping its extension and serves it from the app's own /storage route. Attackers can host HTML/JS/SVG phishing or malware on your domain and fill storage; code execution only if PHP runs in the upload directory. Public PoC in issue #2; no fix, maintainer silent.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams self-hosting MomoTommy/file-management-system (a Laravel app) with /api/files reachable from the network. The upload route needs no login in the reporter's reproduction, so anyone who can reach it can store files and have them served from your own domain. Deployments not running this code, not exposed to the network, or with auth added in front of the API can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| MomoTommy/file-management-system | github | commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114262")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.