CVE-2026-114262: file-management-system FileController.php store unrestricted upload
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction, based on the supplied CVSS vector. Exploitation targets the File argument handled by the store function in app/Http/Controllers/FileController.php.
Is public exploitation information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Are fixed or affected release versions available?
No specific affected or updated versions are available because the product uses a rolling release model. The affected code is identified by commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df.
Is a vendor response or patch known to be available?
No. The project was notified through an issue report but had not responded at the time of the provided information.