Unrestricted file upload in file-management-system FileController
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284 and CWE-434.
Summary
The file-management-system project at commit dc9ce1b is affected, and the project ships a rolling release without version numbers. The store function in FileController.php does not restrict the type of uploaded files (CWE-434). A remote attacker without privileges can upload files. A public exploit has been disclosed and is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | file-management-system | dc9ce1b | — | No fix listed | CNA |
- file-management-system Vendor— Affected dc9ce1b Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:file-management-system:file-management-system:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:file-management-system:file-management-system:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for file-management-system.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114262
- 2026-10-21 Alias added: GHSA-prff-qhhj-5r4c
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-28 CISA SSVC decision points changed
- 2026-10-28 Priority changed: LOW → HIGH
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Sources
- CVE-2026-114262 · CVE Program
- CVE-2026-114262 · NVD
- FIRST EPSS
- GHSA-prff-qhhj-5r4c · GitHub Advisory Database · CC BY 4.0
- CVE-2026-114262 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences