File Management System CVE-2026-114256

Exploitation targets the Folder Management functions (save_folder, delete_folder, delete_file, file_rename, save_files) in admin_class.php and requires sending malicious values in the name, parent_id, id, type, folder_id, or description parameters. The supplied CVSS vector (PR:N) claims no authentication is required, but these endpoints belong to the admin class, so real exploitability likely depends on whether the administrative interface is exposed without a valid admin session - a key limiting factor defenders must verify. There is no required user interaction (UI:N). Because the project ships as a rolling release with no versioning, no patched build is available, so exposure is bounded only by whether the vulnerable admin endpoints are network-reachable.

This is a CWE-89 SQL injection reachable over the network with a publicly available exploit, but the aggregate signals point to a moderate rather than urgent priority. The VulDB-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) implies trivial unauthenticated remote exploitation, yet the impacts are rated only partial (VC:L/VI:L/VA:L) and the overall score is 6.9 (Medium). The exploitation status is 'E:P' (Proof-of-Concept) and a public PoC exists, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of widespread or automated exploitation - treat this as opportunistic PoC-driven risk, not confirmed active exploitation. A notable conflict: the vulnerable code lives in admin_class.php within a 'Folder Management' admin component, which normally implies an authenticated administrative context, yet the supplied vector asserts PR:N (no privileges). This discrepancy should be verified against the actual code path - if the vulnerable endpoints genuinely require an admin session, real-world risk is lower than the PR:N vector suggests. Finally, the affected product is a small open-source PHP project with no enterprise footprint, which further limits aggregate real-world risk despite the network attack vector.

A remote attacker sends crafted input to one of the Folder Management endpoints (save_folder, delete_folder, delete_file, file_rename, or save_files) in admin_class.php, injecting SQL through parameters such as name, parent_id, id, type, folder_id, or description. Because a public PoC is available (linked from the project's GitHub issue tracker), the attacker can reliably manipulate database queries to read or alter folder/file records. The CVSS AC:L and AV:N indicate low-complexity remote delivery over HTTP, though reachability may depend on whether the admin endpoints are accessible without authentication.