---
id: "CVE-2026-114262"
kind: "vulnerability"
aliases: ["CVE-2026-114262"]
title: "file-management-system: unrestricted file upload in FileController store endpoint"
severity: "high"
cvss: 7.5
epss: 0.0037
exploited: false
status: "open"
category: "other"
products: [{"name": "MomoTommy/file-management-system", "fixed": [], "affected": "commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning)", "ecosystem": "github"}]
ecosystems: []
tags: ["file-management-system", "laravel", "no-fix", "other", "php", "self-hosted"]
not_affected_if: ["auth-middleware-added", "not-exposed-to-network", "upload-route-not-exposed"]
published_at: "2026-10-21T18:17:26+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:42:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114262", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114262", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:42:32+00:00"}]
---

# file-management-system: unrestricted file upload in FileController store endpoint

MomoTommy/file-management-system (Laravel) FileController::store() accepts any file type up to 10 MB with no login, saves it to the public disk keeping its extension and serves it from the app's own /storage route. Attackers can host HTML/JS/SVG phishing or malware on your domain and fill storage; code execution only if PHP runs in the upload directory. Public PoC in issue #2; no fix, maintainer silent.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:MomoTommy/file-management-system affected commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df (only commit; no versioning) fixed ?

## How to check

- Check whether you run MomoTommy/file-management-system (any copy; the repo has only commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df).
- In app/Http/Controllers/FileController.php, see whether store() validates only 'required|file|max:10240' with no mimes/extensions rule.
- Run: php artisan route:list --path=api/files and check for no auth middleware; from outside, curl -F file=@test.txt http://HOST/api/files returns 201 if exposed.

## Fix

No fixed version or commit exists. Workarounds: put /api/files behind auth:sanctum; add a mimes:/extensions: allowlist to the validate() rule in store(); store uploads outside the public disk or serve with Content-Disposition: attachment and X-Content-Type-Options: nosniff; disable PHP execution in storage/app/public; or block /api/files at the web server.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114262
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114262
- 2026-10-25T03:42:32+00:00 analyst — Read GitHub issue #2 (PoC, reporter): store() has only required|file|max:10240, no auth on /api/files, files served from /storage at app origin; repo has only commit dc9ce1b, no fix, maintainer silent. Same root as sibling CVE-2026-114261 (missing auth). Fix/how_to_check not vendor-verified.

## Documents

- [advisory] VulDB VDB-424694: file-management-system FileController store unrestricted upload https://vuldb.com/vuln/424694
- [advisory] CVE Record CVE-2026-114262 https://www.cve.org/CVERecord?id=CVE-2026-114262
- [describes] Commit history: only initial commit dc9ce1b https://github.com/MomoTommy/file-management-system/commits/main
- [poc] Issue #2: Unrestricted file upload in FileController::store() https://github.com/MomoTommy/file-management-system/issues/2

## From the sources

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_