CVE-2026-119657: FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is a member of any PicHome library can exploit it. The affected permission check validates membership in some library rather than authorization for the specific target library.
What does an attacker need to target another library?
The attacker needs to know a target library's appid or a folder ID. They can then invoke affected folder operations or retrieve folder data for that foreign library.
What actions are possible through the vulnerable endpoints?
The described operations allow deletion and renaming of folders and reading folder data belonging to another library. The affected operations include deletefolder and rename in folder.php and getfolderdata in rightdata.php.
Are deployments affected by default?
The issue affects FilePress through version 3.0.1 where users can be authenticated and belong to PicHome libraries. Exploitation additionally depends on the attacker obtaining a foreign library appid or folder ID.