The vulnerability arises from unsanitized handling of the ID argument in the readfile endpoint of file-download.php. This allows attackers to inject arbitrary SQL statements, exposing an injection flaw and improper query construction. The impact is the potential for unauthorized data extraction or modification through the database layer, which can compromise confidentiality and integrity of stored files and metadata.

The affected product is oretnom23's file‑management‑system‑php, with the flaw present in all releases up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Because the project follows a rolling release model and does not publish explicit version numbers for the fixed commit, any snapshot of the software prior to the resolution remains vulnerable.

The CVSS score of 6.9 indicates moderate severity. No EPSS value is publicly available, yet the exploit has been disclosed and the vulnerable code is reachable from the internet, making remote exploitation plausible. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented active exploitation campaigns to date, but the presence of a public exploit and remote attack vector warrants prompt action.