file-management-system: Unrestricted file upload (CVE-2026-114262)
A vulnerability in file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) allows for unrestricted file upload via the FileController.php store function.
CVE search metadata
CVE search record: CVE-2026-114262. Severity: high. CVSS: 7.3. KEV: no. Product: file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df). Brief: file-management-system: Unrestricted file upload (CVE-2026-114262). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2026-114262-file-management-system-unrestricted-upload/
Triage facts
Revision 1- Applicability
- file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 21:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability was identified in the store function of app/Http/Controllers/FileController.php within the file-management-system repository (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df). Manipulating the 'File' argument allows for unrestricted file uploads. The attack can be initiated remotely. The exploit has been publicly disclosed. The project uses a rolling release model, and no specific version information for affected or updated releases is available. The project was informed of the issue but has not yet responded.