CVE-2026-119657 Details
Description
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
A missing authorization vulnerability has been identified in FilePress versions through 3.0.1, specifically within the 'dzz/pichome/library' directory. This vulnerability allows authenticated users to manipulate folders in libraries they do not belong to. The issue arises because the 'checkuserperm_by_uid' function only verifies if a user is a member of any library, not the specific one related to the operation. As a result, attackers aware of another library's 'appid' or folder ID can use 'folder.php' operations such as 'deletefolder' and 'rename', or 'rightdata.php' functions like 'getfolderdata', to delete, modify, or access folders in other libraries.
The vulnerability can be addressed by implementing per-library authorization checks in the affected 'folder' and 'rightdata' operations. This involves verifying that the user is a member of the specific library before allowing any modifications or access to folder data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zyx0814/FilePress | [email protected] | Source CodeVendor |
| https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64 | [email protected] | Source CodeVendor |
| https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50 | [email protected] | Source CodeVendor |
| https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9 | [email protected] | Source CodeVendor |
| https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30 | [email protected] | Source CodeVendor |
| https://github.com/zyx0814/FilePress/issues/76 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idor | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/filepress-through-3.0.1-missing-authorization-in-pichome-library-folder-operations | [email protected] | AdvisoryBundleExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FilePress | <= 3.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |