file-management-system-php CVE-2026-114260

Exploitation requires only that an instance of oretnom23 file-management-system-php be network-reachable and that the AJAX Handler endpoint (delete_folder action in ajax.php) be exposed; the attacker manipulates the ID argument to specify a target folder. No authentication, credentials, or user interaction are required because the endpoint lacks an authentication check (CWE-306, CVSS PR:N/UI:N). The practical limiting factors are deployment-driven rather than technical: the application must be internet- or network-accessible to the attacker, no official patched release exists (rolling releases, unresponsive maintainer), and real-world exposure is constrained by the product's small, niche deployment footprint.

This is a genuinely medium-to-low priority issue rather than a top-tier emergency. The CVSS 4.0 base score of 5.5 reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-user-interaction (UI:N) flaw, but with impact limited to low integrity and low availability (VI:L/VA:L) and no confidentiality impact (VC:N) - consistent with a missing-authentication check on a folder-deletion endpoint, where the worst outcome is unauthorized data/folder deletion rather than code execution or data theft. The input provides no EPSS score and no CISA KEV listing, so there is no evidence of active exploitation or high exploitation probability; the only exploitation signal is a publicly available proof-of-concept referenced via the vendor's GitHub issue tracker (E:P / Proof-of-Concept in the CVSS 4.0 threat metric). SSVC-style reasoning: exploitation is PoC (not active), the endpoint is likely automatable given it is an unauthenticated HTTP request, but technical impact is partial, not total. Note the signals are consistent, not conflicting: CVSS, CWE-306 (Missing Authentication), and the description all agree this is an unauthenticated remote destructive-action bug. The main thing tempering real-world risk is the product itself - a small open-source PHP project with no version/patch data and an unresponsive maintainer - so impact is bounded by the product's limited deployment rather than by any technical mitigation.

A remote, unauthenticated attacker locates an exposed instance of the file-management-system-php application and sends a crafted request directly to the delete_folder action in ajax.php, supplying an arbitrary folder ID. Because the handler performs no authentication check (CWE-306), the server deletes the targeted folder and its contents, causing data loss. A public proof-of-concept exists (disclosed via the project's GitHub issue tracker), lowering the skill required to reproduce the attack.