CVE-2026-119657
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. An attacker who knows another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
Risk Assessment
An attacker can delete, modify, and read folders belonging to other libraries, breaching confidentiality and integrity. Only an authenticated account and knowledge of identifiers are required.
Recommendation
Upgrade FilePress to a version later than 3.0.1. Fix checkuserperm_by_uid to verify permission for the specific library rather than membership in any library.
Other vulnerabilities in FilePress
See all- CVE-2026-111619Medium
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
- CVE-2026-90879High
A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS