Description
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted Upload
Action: Implement Workaround
AI Analysis

Impact

The vulnerability resides in the store method of FileController.php, where the File argument is not validated before acceptance. This flaw allows an attacker to upload any type of file without restriction, which can be leveraged to place malicious files on the server. Based on the description, the attack may be successful if the uploaded file contains executable code, potentially leading to arbitrary code execution. The weakness is an improper access control flaw (CWE-284) combined with an unrestricted file upload (CWE-434).

Affected Systems

The affected product is file-management-system, a project that follows a rolling release model. No specific version information is available for affected or updated releases at this time.

Risk and Exploitability

The CVSS score of 6.9 reflects moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Attacks can be launched remotely by sending crafted upload requests to the store endpoint. Based on the description, it is inferred that the attack vector is remote. The exploit has been publicly disclosed and remains active until an official fix is released, increasing the urgency of mitigating the upload path.

Generated by OpenCVE AI on October 22, 2026 at 03:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Implement application‑level file type validation that accepts only whitelisted extensions and rejects all others, thereby blocking the uncontrolled upload path.
  • Configure the web server to prevent execution of files in the upload directory (e.g., disable PHP in upload folders or use .htaccess rules).
  • Monitor upload logs and network traffic for anomalous activity, and apply an official patch as soon as the vendor releases one.

Generated by OpenCVE AI on October 22, 2026 at 03:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Momotommy
Momotommy file-management-system
Vendors & Products Momotommy
Momotommy file-management-system

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Title file-management-system FileController.php store unrestricted upload
First Time appeared File-management-system
File-management-system file-management-system
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:file-management-system:file-management-system:*:*:*:*:*:*:*:*
Vendors & Products File-management-system
File-management-system file-management-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

File-management-system File-management-system
Momotommy File-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-28T17:15:37.562Z

Reserved: 2026-10-21T06:51:29.020Z

Link: CVE-2026-114262

cve-icon Vulnrichment

Updated: 2026-10-28T17:15:33.473Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T18:17:26.767

Modified: 2026-10-28T18:17:10.820

Link: CVE-2026-114262

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T00:45:13Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type