CVE-2026-111619
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
Risk Assessment
Database data leakage, including administrator password hashes — potential privilege escalation and full system takeover. High risk of confidentiality and integrity breach.
Recommendation
Upgrade FilePress beyond 3.0.1 once available and implement asc parameter validation and query parameterization in filelist.php files. Until a fix is released, consider restricting low-privilege user permissions.
Other vulnerabilities in FilePress
See all- CVE-2026-119657Medium
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. An attacker who knows another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
- CVE-2026-90879High
A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS