SQL Injection in FilePress Publish Module

CVE-2026-90879 describes a high-severity SQL injection vulnerability discovered in the zyx0814 FilePress software, affecting all versions up to and including 3.0.1. The flaw exists within the Publish Module, specifically in the dzz/publish/search.php file. By sending a crafted HTTP request, an unauthenticated remote attacker can inject arbitrary SQL commands via the 'orderby' or 'order' parameters. This vulnerability stems from improper neutralization of special elements used in an SQL command. As of the time of reporting, the project maintainers have not issued a patch to remediate this flaw, and public exploit code is available, increasing the risk of active exploitation. Defenders should monitor web traffic targeting the Publish Module for signs of SQL injection patterns.

Impact

Successful exploitation of this vulnerability allows remote attackers to perform unauthorized database operations, potentially leading to data exfiltration, modification, or, depending on database permissions, remote code execution. Given the public availability of exploit code, all FilePress instances running version 3.0.1 or earlier are at high risk of compromise.

Recommendation

• Implement temporary Web Application Firewall (WAF) rules to inspect and block requests to dzz/publish/search.php containing SQL syntax characters in the 'orderby' or 'order' parameters.
• Monitor web server logs for suspicious spikes in POST or GET requests to the identified vulnerable path that deviate from established baselines.
• Apply the vendor patch as soon as it becomes available; monitor the zyx0814 repository for version 3.0.2 or subsequent security updates.