File Management System EUVD-2026-107305

Exploitation targets the file-inclusion path in index.php where the 'page' request parameter is passed to an include() call without sufficient validation (CWE-73). The CVSS vector's UI:P indicates exploitation is facilitated by passive user interaction (e.g., a victim following or loading an attacker-influenced request) rather than being fully autonomous, which is a limiting factor. No authentication is required (PR:N), and the attack is network-reachable (AV:N) against the application as deployed; however, impact is constrained to LOW (VC:L/VI:L/VA:L), implying limited file disclosure/manipulation rather than arbitrary code execution. There is no fixed version to apply because the product is distributed as a rolling release with no affected/patched version identifiers.

This is a moderate-severity path/file inclusion issue (CWE-73, External Control of File Name or Path) in the index.php 'include' handling via the 'page' parameter. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, score 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw, but one that requires passive user interaction (UI:P) and yields only LOW impact across confidentiality, integrity, and availability rather than full system compromise - consistent with limited file inclusion rather than guaranteed remote code execution. Exploitation signals are mixed: public exploit code exists (disclosed via the vendor's own GitHub issue tracker), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided in the input, so real-world exploitation probability cannot be quantified and should not be assumed widespread. The combination of a hobby-grade, obscure PHP project with no vendor response and only LOW technical impact suggests this is a lower operational priority than its 'network/unauthenticated' labels might imply; the UI:P requirement and modest impact temper the raw accessibility. Net: a genuine but low-to-moderate priority issue, elevated mainly by public POC availability, not by confirmed active exploitation.

A remote attacker crafts a request to index.php supplying a malicious value in the 'page' parameter to influence which file the application includes, potentially exposing local files or application source. Public exploit material has been disclosed in the project's GitHub issue tracker, lowering the barrier to reproduction. The CVSS UI:P metric implies some passive user interaction is a factor, and impact is limited (low confidentiality/integrity/availability) rather than full server takeover.