A flaw in the FileController.php of the MomoTommy file‑management‑system allows an attacker to tamper with the request payload for the destroy method, bypassing the authentication check that normally protects file deletion. This missing authorization lets the attacker delete any stored file without proving identity, effectively removing critical data or configuration files and potentially disrupting the application’s operation.

The vulnerability affects all installations of the MomoTommy file‑management‑system that use its Files API, specifically the destroy endpoint in app/Http/Controllers/FileController.php. Because the project does not use semantic versioning, no specific release numbers are identified; any deployment that includes the vulnerable component is at risk.

The CVSS score of 6.9 indicates moderate severity, and the public exploit indicates the issue is plausible. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, but the remote nature of the attack and the lack of authentication make it a concrete threat that should be addressed promptly.