{"id":"CVE-2026-114262","kind":"vulnerability","aliases":["CVE-2026-114262"],"related":[],"title":"file-management-system: unrestricted file upload in FileController store endpoint","description":"A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"MomoTommy/file-management-system (Laravel) FileController::store() accepts any file type up to 10 MB with no login, saves it to the public disk keeping its extension and serves it from the app's own /storage route. Attackers can host HTML/JS/SVG phishing or malware on your domain and fill storage; code execution only if PHP runs in the upload directory. Public PoC in issue #2; no fix, maintainer silent.","severity":"high","cvss":7.5,"epss":0.0037,"exploited":false,"exploited_at":null,"products":[{"name":"MomoTommy/file-management-system","fixed":[],"affected":"commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning)","ecosystem":"github"}],"ecosystems":[],"tags":["file-management-system","laravel","no-fix","other","php","self-hosted"],"not_affected_if":["auth-middleware-added","not-exposed-to-network","upload-route-not-exposed"],"how_to_check":"- Check whether you run MomoTommy/file-management-system (any copy; the repo has only commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df).\n- In app/Http/Controllers/FileController.php, see whether store() validates only 'required|file|max:10240' with no mimes/extensions rule.\n- Run: php artisan route:list --path=api/files and check for no auth middleware; from outside, curl -F file=@test.txt http://HOST/api/files returns 201 if exposed.","fix":"No fixed version or commit exists. Workarounds: put /api/files behind auth:sanctum; add a mimes:/extensions: allowlist to the validate() rule in store(); store uploads outside the public disk or serve with Content-Disposition: attachment and X-Content-Type-Options: nosniff; disable PHP execution in storage/app/public; or block /api/files at the web server.","status":"open","published_at":"2026-10-21T18:17:26+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:28+00:00","updated_at":"2026-10-25T03:42:32+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T03:16:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"file-management-system: unrestricted file upload in FileController store endpoint","impact":"high","summary":"A file-management-system PHP app's store function in FileController.php accepts uploaded files without restriction. A remote attacker can upload arbitrary files, and the exploit is publicly disclosed.","category":"other","nicknames":[],"who_cares":["php","file-management-system","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; unrestricted upload may allow arbitrary file placement on the server","analyst_note":"Confirm the fix status and whether authentication is required for the store route at https://nvd.nist.gov/vuln/detail/CVE-2026-114262; the project has not responded so no fixed version is known.","how_to_check":"- Check whether the deployment runs file-management-system from the project repository at commit `dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df` or a rolling-release copy of it\n- Look at `app/Http/Controllers/FileController.php` in the deployed code and review the `store` function's handling of the `File` upload argument","needs_analyst":true,"not_affected_if":["upload-route-not-exposed"],"who_is_affected":"Teams running the file-management-system project (a PHP/Laravel-style app with a FileController upload endpoint) that expose the store upload route. The sources do not say whether a default configuration is exposed or whether an account is required, and the project has not responded to the report. Deployments that do not run this code or do not expose the upload route can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3452,"output_tokens":581,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fix status and whether authentication is required for the store route at https://nvd.nist.gov/vuln/detail/CVE-2026-114262; the project has not responded so no fixed version is known.","search":"'-114262':14A,17A '-2026':13A,16A '/storage':64B '10':42B '2':93B 'accept':36B 'affect':160C 'app':61B 'app/http/controllers/filecontroller.php':116C 'argument':121C 'attack':66B,127C 'avail':166C 'caus':123C 'code':79B 'continu':151C 'cve':12A,15A 'dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df':107C 'deliv':150C 'determin':101C 'directori':88B 'disclos':137C 'disk':52B 'domain':75B 'earli':174C 'endpoint':11A 'execut':80B 'exploit':133C 'extens':55B 'file':2A,6A,20B,38B,104C,115C,122C 'file-management-system':1A,19B,103C 'filecontrol':9A,34B 'fill':77B 'fix':26B,95B 'function':111C 'host':31B,68B 'html/js/svg':69B 'impact':108C 'inform':158C,170C 'initi':130C 'issu':92B,177C 'keep':53B 'laravel':23B,33B 'login':46B 'maintain':96B 'malwar':72B 'manag':3A,21B,105C 'manipul':118C 'may':128C,139C 'mb':43B 'model':148C 'momotommy/file-management-system':18A,32B 'no-fix':24B 'phish':70B 'php':28B,83B 'poc':90B 'problem':173C 'product':143C 'project':168C 'public':51B,89B,136C 'releas':147C,163C 'remot':131C 'report':178C 'respond':182C 'result':155C 'roll':146C 'rout':65B 'run':84B 'save':47B 'self':30B 'self-host':29B 'serv':57B 'silent':97B 'specif':156C 'storag':78B 'store':10A,35B,112C 'system':4A,22B,106C 'type':39B 'unrestrict':5A,124C 'updat':152C,162C 'upload':7A,87B,125C 'use':144C 'util':141C 'version':157C 'vulner':99C 'yet':183C","nicknames":[],"mitigations":[],"who_affected":"Teams self-hosting MomoTommy/file-management-system (a Laravel app) with /api/files reachable from the network. The upload route needs no login in the reporter's reproduction, so anyone who can reach it can store files and have them served from your own domain. Deployments not running this code, not exposed to the network, or with auth added in front of the API can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114262","severity":null,"published_at":"2026-10-21T18:17:26+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114262","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114262","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114262:773","url":null,"severity":null,"published_at":"2026-10-25T03:42:32+00:00","modified_at":"2026-10-25T03:42:32+00:00","first_seen_at":"2026-10-25T03:42:32+00:00","fetched_at":"2026-10-25T03:42:32+00:00","note":"Read GitHub issue #2 (PoC, reporter): store() has only required|file|max:10240, no auth on /api/files, files served from /storage at app origin; repo has only commit dc9ce1b, no fix, maintainer silent. Same root as sibling CVE-2026-114261 (missing auth). Fix/how_to_check not vendor-verified."}],"documents":[{"id":3131,"url":"https://vuldb.com/vuln/424694","title":"VulDB VDB-424694: file-management-system FileController store unrestricted upload","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3132,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114262","title":"CVE Record CVE-2026-114262","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3300,"url":"https://github.com/MomoTommy/file-management-system/issues/2","title":"Issue #2: Unrestricted file upload in FileController::store()","kind":"issue","source":"analyst","text":"Open issue by ThanatosXingYu, 2026-10-07, commit dc9ce1b. store() validates only required|file|max:10240, saves to the public disk with original extension; no mimes/extensions rule. Route is unauthenticated (/api/files). Files served from /storage/{filename} at app origin with native Content-Type (text/html confirmed). curl repro: curl -F file=@payload.sh $BASE_URL/api/files returns 201. Reporter CVSS 3.1 5.3. Code execution only if PHP execution is enabled for the upload dir.","published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3141,"url":"https://github.com/MomoTommy/file-management-system/commits/main","title":"Commit history: only initial commit dc9ce1b","kind":"other","source":"analyst","text":"Only one commit (dc9ce1b, Aug 8 2024, Initial commit). No fix or newer commit as of 2026-10-25. Issues #1 and #2 open.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}