A vulnerability exists in the Folder Management component of oretnom23 file-management-system-php. The save_folder/delete_folder/delete_file/file_rename/save_files functions handle inputs such as name, parent_id, id, type, folder_id, and description without proper sanitization, allowing attackers to inject arbitrary SQL commands. The flaw can be exploited remotely, and public exploit code is available, permitting attackers to run arbitrary SQL queries against the database.

All releases of oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 are affected. The project follows a rolling release model and has not released a fixed version yet, so any deployment that has not applied the most recent commit is vulnerable.

The CVSS score of 6.9 indicates moderate severity. The vulnerability can be exploited remotely and public exploit code has been made available. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. Because the application can be accessed from outside the network, the likelihood of real‑world exploitation remains significant.