CVE-2026-114262: file-management-system, заобикаляне на вход и права

Описание

Оригинално описание

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Засегнати продукти

• n/a file-management-system: dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df

Вид слабост

• CWE-434 Неограничено качване на файл от опасен тип
• CWE-284 Неправилен контрол на достъпа

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-114262
• https://nvd.nist.gov/vuln/detail/CVE-2026-114262
• https://vuldb.com/vuln/424694
• https://vuldb.com/vuln/424694/cti
• https://vuldb.com/cve/CVE-2026-114262
• https://vuldb.com/submit/1018614
• https://github.com/MomoTommy/file-management-system/issues/2