---
id: "CVE-2026-119657"
kind: "vulnerability"
aliases: ["CVE-2026-119657"]
title: "FilePress: authenticated users can delete or read other libraries' folders"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["filepress", "package", "self-hosted"]
not_affected_if: ["no-shared-accounts"]
published_at: "2026-10-30T15:16:49+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:33:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119657", "first_seen_at": "2026-10-30T15:31:10+00:00"}]
---

# FilePress: authenticated users can delete or read other libraries' folders

FilePress through 3.0.1 checks only that a user belongs to some library, not the target library, in its folder endpoints. A logged-in user who knows another library's ID or folder ID can delete, rename, or read that library's folders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FilePress version; the sources say the flaw affects versions through `3.0.1`.
- Look for the `dzz/pichome/library` endpoints (folder.php, rightdata.php) in your deployment.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119657

## From the sources

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_