FilePress through version 3.0.1 suffers from a missing authorization flaw in the PicHome library folder functions. The vulnerability allows any authenticated user to manage folders belonging to other libraries because the permission check only verifies membership in any library. An attacker who discovers another library's appid or folder id can use folder.php actions such as deletefolder or rename, or rightdata.php actions like getfolderdata, to delete, alter, or read folders that do not belong to the user. The flaw enables unauthorized alteration or removal of data and could expose sensitive information stored in foreign folders.

The vendor zyx0814 provides FilePress, and the affected product is FilePress via the PicHome library. Versions up to and including 3.0.1 are vulnerable. No newer version information is supplied, so any deployment using 3.0.1 or earlier is impacted.

The CVSS score of 2.3 indicates a low severity but the vulnerability relies on an authenticated user. Exploitation requires knowledge of another library’s appid or folder id. Because the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation appears low, yet the missing authorization could be abused in targeted scenarios. Attackers would need to be authenticated but can then freely delete, rename, or read foreign folders if the other library’s identifiers are known.