Engineercms CVE-2026-111652

No authentication, user interaction, or special configuration is required: with CVSS PR:N/UI:N/AC:L the flaw is reachable against default deployments of Engineercms (versions through 2.0.5) wherever the web interface is network-accessible. The only real prerequisite is that the attacker can reach the application and can guess or derive valid /attachment/* paths. Exploitation is inherently LIMITED in impact rather than in access: only project attachments with .jpg, .png, .bmp, or .mp4 extensions are exposed - not arbitrary files, source code, or credentials - and no write, modification, or service-disruption capability is granted.

This is a genuine but modest-severity exposure. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) consistently describes a low-confidentiality-only information disclosure: network-reachable, low complexity, no privileges, no user interaction, but with only partial confidentiality impact and zero integrity or availability impact. The 6.9 base score overstates practical urgency because the leaked data is limited to specific media attachment types (.jpg, .png, .bmp, .mp4) rather than arbitrary files or credentials. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit code is flagged in the input, so there is no evidence of active or at-scale exploitation. A third-party technical writeup (hackmd) and a direct source-code line reference exist, which lowers the barrier to reproduction, but a writeup is not the same as confirmed weaponized exploit code. Net: a real, easily-reproducible authorization flaw that is a reasonable patching priority for exposed Engineercms instances, but not an emergency given the narrow data exposure and absence of exploitation signals. Note a minor labeling nuance - the issue is missing authorization (CWE-862), not a true authentication bypass as one tag suggests.

An unauthenticated attacker who can reach an Engineercms instance enumerates or derives predictable /attachment/* URLs and requests media files (e.g. /attachment/<id>.mp4 or .png) directly. Because the files are served before casbin, owner, and admin authorization checks run, the server returns private project images and videos without any login. A public technical writeup describing the flaw exists, making reproduction straightforward even without packaged exploit code.