MomoTommy File Management EUVD-2026-107367

Exploitation requires only network reachability to the application's Files API; the index/store/update/destroy actions in app/Http/Controllers/FileController.php lack authentication entirely (CWE-306), so no credentials, tokens, or user interaction are needed against a default deployment. The practical limiting factor is exposure and footprint, not configuration: the instance must be network-accessible to the attacker, and because this is a niche, unversioned hobby project there is no confirmed patched release to apply - mitigation depends on the operator adding an authentication layer or restricting network access.

This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which aligns with the CWE-306 missing-authentication root cause on the Files API CRUD endpoints. However, impact is rated only Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L, SC/SI/SA:N), holding the base score to 5.5 (Medium). Exploit maturity is Proof-of-Concept (E:P), and the input confirms a publicly available exploit, so the exploitation signal is 'publicly available exploit code exists' - distinct from active exploitation. This CVE is NOT in CISA KEV, and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified from available data. The dominant risk-limiting factor is prevalence: this is an unversioned individual GitHub project whose maintainer was notified via an issue report but has not responded, meaning real-world deployment is minimal and no patch is confirmed. Net assessment: easy to exploit where deployed, but very low deployment footprint keeps real-world risk low to moderate.

A remote attacker discovers an internet-exposed instance of the file-management-system and sends crafted HTTP requests directly to the Files API endpoints (index/store/update/destroy) without any credentials, exploiting the missing authentication check in FileController.php to list, upload, modify, or delete files. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), lowering the skill needed. Low attack complexity and no required user interaction make opportunistic exploitation straightforward against any exposed deployment.