CVE-2026-114262

Deferred Deferred - Pending Action

Unrestricted File Upload in File Management System

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulDB

Description

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114262

EUVD

EUVD-2026-107394

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	file-management-system	dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an unrestricted file upload flaw in a file management system. It allows attackers to upload any file type without proper validation, including malicious files like HTML, JavaScript, or malware. The only restriction is a 10 MB size limit. Uploaded files are stored in a public directory and served via the application's /storage route, enabling attackers to host malicious content from the application's trusted domain.

Detection Guidance

Check for unexpected files in the public storage directory, especially with executable extensions like .php, .html, or .svg. Monitor network traffic for unusual upload requests to the /storage route. Review logs for large file uploads exceeding 10 MB or files with suspicious names.

Impact Analysis

This vulnerability can lead to phishing attacks, cross-site scripting (XSS), storage exhaustion, and potential code execution if PHP execution is enabled in the upload directory. Attackers could upload malicious files that appear to come from a trusted source, tricking users into downloading harmful content or executing scripts.

Mitigation Strategies

Disable file uploads if not essential. Implement strict file type validation, blocking all executable and script formats. Restrict upload directory permissions to prevent PHP execution. Set up size limits below 10 MB and monitor storage usage. Update the FileController to enforce these restrictions.

Hi! I’m here to help you understand CVE-2026-114262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...