CVE-2026-8133 Details
Description
A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of the file dzz/shares/admin.php of the component Shares Filelist API. Such manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is e20ec58414103f781858f2951d178e19b1736664. A patch should be applied to remediate this issue.
A critical SQL injection vulnerability has been identified in zyx0814 FilePress versions through 2.2.0. The issue resides in the Shares Filelist API, specifically within the 'dzz/shares/admin.php' file. The vulnerability arises because the 'order' parameter is directly concatenated into the SQL 'ORDER BY' clause without proper validation or parameterization. This flaw allows remote attackers to inject arbitrary SQL expressions. The vulnerability has been publicly disclosed and exploited, leading to unauthorized access to sensitive database information, including admin password hashes.
A patch has been released that normalizes the 'order' parameter to handle different case variants and adds proper validation to prevent SQL injection. This patch should be applied to address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xiaohaiyang-ai/Web-Security-Research/tree/main/FilePress/Shares-API-PreAuth-SQLi | [email protected] | ExploitTechnical Analysis |
| https://github.com/zyx0814/FilePress/ | [email protected] | ProductSource CodeVendor |
| https://github.com/zyx0814/FilePress/commit/e20ec58414103f781858f2951d178e19b1736664 | [email protected] | Source CodeVendor |
| https://github.com/zyx0814/FilePress/issues/70 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/zyx0814/FilePress/pull/71 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/submit/808819 | [email protected] | Permission Required |
| https://vuldb.com/vuln/361923 | [email protected] | AdvisoryPermission RequiredRemedy |
| https://vuldb.com/vuln/361923/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zyx0814 FilePress | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |