FilePress EUVD-2026-103041

Requires a valid low-privilege authenticated session on the FilePress instance (PR:L) - not exploitable by anonymous/unauthenticated attackers. The specific prerequisite is reaching the file-listing endpoints dzz/pichome/library/filelist.php or dzz/collection/filelist.php and supplying the unvalidated asc sort-direction parameter, which is concatenated into the SQL ORDER BY clause. No non-default configuration or user interaction is needed beyond holding any authenticated account; the limiting factors are the authentication requirement and the affected version range (through 3.0.1). The injection is read/inference-based (blind boolean or time-based), so exploitation yields data extraction rather than data modification.

This is a moderate-risk, authenticated SQL injection (CWE-89) that is a genuine but contained priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring low-privilege authentication (PR:L) - not unauthenticated, which meaningfully lowers mass-exploitation potential. Impact is confidentiality-only (VC:H, VI:N/VA:N), consistent with a read-only ORDER BY injection used to exfiltrate data including administrator credential hashes; those hashes could then enable privilege escalation, so the effective blast radius exceeds the raw confidentiality-only metric. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no signal of active or probable widespread exploitation; however, a detailed public technical write-up (hackmd) and a VulnCheck advisory exist, meaning the injection path (the asc parameter) and vulnerable source lines are publicly documented and reproducible. Net: a real, well-documented flaw worth patching, but the authentication requirement and niche product footprint keep it below internet-facing-critical urgency. Missing data to note: no EPSS and no KEV status were supplied, so widespread-exploitation likelihood cannot be quantified from the input.

A low-privileged authenticated user of a FilePress (zyx0814/FilePress ≤3.0.1) instance submits a crafted asc parameter to dzz/pichome/library/filelist.php or dzz/collection/filelist.php, injecting a blind boolean or time-based subquery into the ORDER BY clause. By observing response behavior or timing differences, the attacker iteratively extracts database contents - notably administrator password hashes - which can then be cracked offline to escalate to full administrative access. A public technical write-up documents the vulnerable code paths and injection technique, making reproduction straightforward, though no packaged exploit tool was listed in the input.