Live › vulnerability › CVE-2026-119657
FilePress through 3.0.1 checks only that a user belongs to some library, not the target library, in its folder endpoints. A logged-in user who knows another library's ID or folder ID can delete, rename, or read that library's folders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Deployments of FilePress through version 3.0.1 where user accounts can log in and use the library folder features. The exposure depends on users sharing one instance and knowing other libraries' IDs; the sources do not say whether single-user installs are affected. Teams running only a single library or no shared accounts can rank this lower.
No product ranges from the sources yet.
3.0.1.dzz/pichome/library endpoints (folder.php, rightdata.php) in your deployment.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
This page as .md · .json · in your agent: get_signal("CVE-2026-119657")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.