{"id":"CVE-2026-119657","kind":"vulnerability","aliases":["CVE-2026-119657"],"related":[],"title":"FilePress: authenticated users can delete or read other libraries' folders","description":"FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.","summary":"FilePress through 3.0.1 checks only that a user belongs to some library, not the target library, in its folder endpoints. A logged-in user who knows another library's ID or folder ID can delete, rename, or read that library's folders.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["filepress","package","self-hosted"],"not_affected_if":["no-shared-accounts"],"how_to_check":"- Check the installed FilePress version; the sources say the flaw affects versions through `3.0.1`.\n- Look for the `dzz/pichome/library` endpoints (folder.php, rightdata.php) in your deployment.","fix":null,"status":"open","published_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:49+00:00","updated_at":"2026-10-30T15:33:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T15:33:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FilePress: authenticated users can delete or read other libraries' folders","impact":"medium","summary":"FilePress through 3.0.1 checks only that a user belongs to some library, not the target library, in its folder endpoints. A logged-in user who knows another library's ID or folder ID can delete, rename, or read that library's folders.","audience":"businesses","category":"package","nicknames":[],"who_cares":["filepress","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Other libraries' folders get deleted, renamed, or read by a logged-in user","analyst_note":"","how_to_check":"- Check the installed FilePress version; the sources say the flaw affects versions through `3.0.1`.\n- Look for the `dzz/pichome/library` endpoints (folder.php, rightdata.php) in your deployment.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["no-shared-accounts"],"who_is_affected":"Deployments of FilePress through version `3.0.1` where user accounts can log in and use the library folder features. The exposure depends on users sharing one instance and knowing other libraries' IDs; the sources do not say whether single-user installs are affected. Teams running only a single library or no shared accounts can rank this lower.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4165,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119657':13A,16A '-2026':12A,15A '3.0.1':24B,67C 'allow':76C 'anoth':49B,97C 'appid':100C 'attack':94C 'authent':2A,77C 'author':71C 'belong':30B 'check':25B,89C 'checkuserperm':85C 'contain':68C 'cve':11A,14A 'delet':5A,57B,116C 'deletefold':109C 'dzz/pichome/library':74C 'endpoint':41B 'filepress':1A,17B,22B,65C 'folder':10A,40B,54B,64B,83C,102C,121C 'folder.php':106C 'foreign':120C 'getfolderdata':114C 'host':21B 'id':52B,55B,103C 'invok':105C 'know':48B,96C 'librari':9A,33B,37B,50B,62B,82C,93C,98C 'like':108C 'log':44B 'logged-in':43B 'manag':80C 'membership':90C 'miss':70C 'modifi':117C 'oper':107C 'packag':18B 'read':7A,60B,119C 'renam':58B,111C 'rightdata.php':113C 'self':20B 'self-host':19B 'target':36B 'uid':87C 'user':3A,29B,46B,78C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Deployments of FilePress through version `3.0.1` where user accounts can log in and use the library folder features. The exposure depends on users sharing one instance and knowing other libraries' IDs; the sources do not say whether single-user installs are affected. Teams running only a single library or no shared accounts can rank this lower.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119657","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119657","severity":null,"published_at":"2026-10-30T15:16:49+00:00","modified_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}