CVE-2026-114260

Deferred Deferred - Pending Action

Authentication Bypass in File Management System PHP

Publication date: 2026-10-21

Last updated on: 2026-10-23

Assigner: VulDB

Description

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114260

EUVD

EUVD-2026-107364

Affected Vendors & Products

Vendor	Product	Version / Range
oretnom23	file-management-system-php	2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication issue in the File Management System PHP application. It allows unauthenticated attackers to delete or modify any user's files and folders by sending crafted requests to the ajax.php file. The flaw exists because the backend does not verify user sessions or ownership before executing actions like deletion.

Detection Guidance

Check for unauthorized access attempts to the ajax.php file in the file-management-system-php application. Monitor network traffic for suspicious requests targeting the delete_folder function without valid session tokens. Inspect server logs for unusual deletion or modification activities on user files or folders.

Impact Analysis

This vulnerability can lead to complete data loss or integrity compromise. Attackers can remotely delete or modify files without authentication, potentially removing physical files from the server. It may also allow unauthorized access to sensitive data through file manipulation.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and integrity. It could lead to unauthorized data access or loss, which is a breach of GDPR and HIPAA. Organizations using this software may face legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the ajax.php file by implementing proper authentication checks. Ensure all file operations require valid session verification. Temporarily disable the delete_folder function if possible until a patch is applied. Monitor for any ongoing exploitation attempts.

Hi! I’m here to help you understand CVE-2026-114260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...