file-management-system-php EUVD-2026-107336

Exploitation requires network reach to the download.php endpoint of the File Download component with an attacker-controlled 'ID' request parameter; per CVSS 4.0 AV:N/AC:L/PR:N/UI:N this needs no authentication, no user interaction, and works against the default application as shipped. The practical limiting factors are not configuration-based but deployment-based: the product is an obscure, single-developer PHP project with negligible real-world installation, and no fixed release exists (rolling release, maintainer has not responded), so remediation currently depends on manual code patching or removing the component.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates this is remotely reachable, low-complexity, and requires no authentication or user interaction, which normally argues for prioritization. However, the impact metrics are uniformly LOW (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N), yielding a moderate base score of 6.9 - notably restrained for a SQL injection (CWE-89), where full database read/write and authentication bypass would typically justify HIGH confidentiality/integrity impact. This suggests VulDB assessed the injection as limited in reachable data or exploitable surface rather than a full database compromise. The vector carries E:P (Proof-of-Concept), consistent with the publicly disclosed exploit, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread, or automated exploitation. Net: this is a real, publicly-exploitable, unauthenticated flaw, but the combination of a tiny-footprint hobby product, low technical impact, and absence of KEV/EPSS signals places it well below genuinely urgent priorities. MISSING DATA: EPSS probability not provided; prioritize by asset exposure rather than raw score.

A remote, unauthenticated attacker sends a crafted value in the 'ID' parameter to download.php, injecting SQL into the query backing the readfile-based File Download component. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), so weaponization requires minimal skill; low attack complexity (AC:L) means no special timing or preconditions are needed.