CVE-2026-114261: MomoTommy file-management-system Files API FileController.php destroy missing authentication
A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The affected Files API endpoints can be attacked remotely without authentication. The vulnerable controller functions are index, store, update, and destroy.
What could an attacker do through the vulnerable API?
The issue affects file listing, creation, modification, and deletion operations exposed by the Files API. The reported impact includes partial compromise of confidentiality, integrity, and availability.
How can I determine whether my deployment is affected?
Check whether your deployment uses MomoTommy file-management-system at commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df and exposes the Files API FileController.php endpoints. Release-based affected-version determination is not available because the project does not use versioning.
Is there a patch or vendor response available?
No vendor response is reported. The project was notified through an issue report, but had not responded at the time of publication.
What should be done if patching is not available?
The provided information does not identify a patch or workaround. Because exploitation is remote and public exploit information exists, prioritize restricting access to the affected Files API endpoints until a vendor response is available.