FilePress Missing Authorization in PicHome Library Folder Operations
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
FilePress through 3.0.1 contains a missing authorization flaw in the dzz/pichome/library component, tracked as CWE-639. The check only confirms that a user belongs to some library, so authenticated users can manage folders in libraries they do not belong to. An attacker who knows another library's appid or folder id can delete, rename, or read those folders through folder.php and rightdata.php.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for FilePress.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119657
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Alias added: GHSA-6vrq-vfh4-v7v2
References
Advisory 1
Other 6
- https://github.com/zyx0814/FilePress/issues/76
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30
- https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64
- https://github.com/zyx0814/FilePress
More zyx0814 vulnerabilities
- TI-2026-61757 zyx0814 FilePress Publish search.php sql injection CVSS 4.0MEDIUM 6.9
- TI-2026-07164 zyx0814 FilePress Shares Filelist API admin.php sql injection CVSS 4.0MEDIUM 6.9
- TI-2025-01500 zyx0814 Pichome index.php path traversal CVSS 4.0MEDIUM 6.9
- TI-2026-75405 SQL injection in FilePress via the asc parameter CVSS 4.0HIGH 7.1
Sources
- CVE-2026-119657 · CVE Program
- CVE-2026-119657 · NVD
- FIRST EPSS
- GHSA-6vrq-vfh4-v7v2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences