Description
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized folder deletion
Action: Assess Impact
AI Analysis

Impact

A flaw in the delete_folder routine of the file-management-system-php’s AJAX handler allows an attacker to specify an ID value and delete a folder without being authenticated. The missing authentication check is a classic authorization bypass (CWE‑287) and also represents an authorization failure (CWE‑306), giving the attacker the ability to remove data that should have been protected by user credentials.

Affected Systems

All releases of oretnom23 file‑management‑system‑php up to the code revision 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 are vulnerable. No patch or fixed version has been released and the project uses continuous delivery, so the most recent commit may still contain the flaw. The source code is hosted on GitHub but the maintainer has not yet responded to the issue report.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk level, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. It can be exploited remotely through a crafted request to ajax.php/delete_folder, and the attacker only needs network connectivity to the web application; no local privileges are required.

Generated by OpenCVE AI on October 22, 2026 at 03:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Add an authentication check to the delete_folder handler so that only authenticated and authorized users may delete a folder.
  • Restrict access to the AJAX endpoint by requiring an authenticated session cookie or by implementing network‑level filtering to block unauthenticated clients.
  • Monitor the project’s issue tracker for an official fix, and apply the latest commit that may contain a patch or apply a custom patch that inserts proper authentication checks.

Generated by OpenCVE AI on October 22, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Title oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
First Time appeared Oretnom23
Oretnom23 file-management-system-php
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*
Vendors & Products Oretnom23
Oretnom23 file-management-system-php
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Oretnom23 File-management-system-php
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-23T22:05:33.996Z

Reserved: 2026-10-21T06:51:20.697Z

Link: CVE-2026-114260

cve-icon Vulnrichment

Updated: 2026-10-23T18:02:44.261Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T17:18:26.223

Modified: 2026-10-23T23:17:42.990

Link: CVE-2026-114260

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T03:45:18Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function