File Management System CVE-2026-114258

Exploitation requires reaching the files.php script of the File Management component and supplying attacker-controlled input in the fid or id parameter, which is injected into a SQL query without sanitization. No special configuration, authentication, or user interaction is required (PR:N/UI:N/AC:L), so default deployments reachable over the network are exploitable. The primary limiting factors are not technical but environmental: the application must be network-accessible to the attacker, and because the product is an obscure rolling-release project with no versioned releases, realistic exposure depends entirely on whether an instance is deployed and internet-facing - the Low impact ratings also cap the damage to limited data disclosure/modification rather than full host or database takeover.

This is a medium-severity SQL injection (CWE-89) in oretnom23's file-management-system-php, with a CVSS 4.0 base score of 6.9. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which normally signals high exploitability; however, the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact (SC:N/SI:N/SA:N), which is what holds the score at medium rather than critical. The E:P threat metric and the 'exploit is now public' statement confirm proof-of-concept exploit code exists, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided, so the real-world exploitation probability cannot be quantified from the input. The signals are internally consistent (network vector in CVSS matches 'initiate the attack remotely' in the description), so there is no conflict to flag - the main caveat is that the Low impact ratings suggest the injection yields limited data access/manipulation rather than full database compromise, and real priority is tempered heavily by the product's likely tiny deployment footprint. Net: a genuine, publicly-exploitable unauthenticated SQLi, but low practical priority for most organizations because the affected software is an obscure hobby/tutorial-grade project rather than widely-deployed enterprise software.

A remote, unauthenticated attacker sends a crafted request to files.php with a malicious value in the fid or id parameter, injecting SQL that the File Management component executes against the backend database. Public proof-of-concept exploit code exists (referenced via the project's GitHub issue tracker), lowering the barrier to opportunistic exploitation. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the attacker can read or tamper with limited database contents directly.