CVE-2026-111619: FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs an authenticated low-privilege FilePress account. No user interaction is required, and the vulnerable parameter is reachable over the network.
What could an attacker obtain through this vulnerability?
An attacker can use blind boolean- or time-based SQL subqueries to extract database data. The disclosed impact includes administrator credential hashes.
Which components should be checked for exposure?
Check FilePress installations through version 3.0.1, specifically the file-listing code in dzz/pichome/library/filelist.php and dzz/collection/filelist.php. The issue is associated with the unvalidated asc parameter used in ORDER BY clauses.
How can defenders look for exploitation attempts?
Review application and web-server logs for authenticated requests to the affected file-list functionality containing unusual asc values, especially SQL expressions, boolean conditions, or delay-oriented database functions. Because extraction can be blind, repeated similar requests and anomalous response timing may also be relevant indicators.