File-Management-System - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/file-management-system/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 19:16:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMomoTommy file-management-system: Authentication bypass (CVE-2026-114261)https://feed.craftedsignal.io/briefs/2026-10-momo-tommy-auth-bypass/Wed, 21 Oct 2026 19:16:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-momo-tommy-auth-bypass/A missing authentication vulnerability in the MomoTommy file-management-system Files API allows remote attackers to manipulate request arguments to gain unauthorized access to file operations.A vulnerability exists in the MomoTommy file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) within the Files API component. Specifically, the 'index', 'store', 'update', and 'destroy' functions in 'app/Http/Controllers/FileController.php' fail to properly validate authentication when specific request arguments are manipulated. This vulnerability allows for unauthenticated remote access to file management operations. As the project does not use formal versioning and has not responded to vulnerability reports, there is no vendor patch available.

Impact

Remote unauthenticated attackers can perform unauthorized file operations, including creating, reading, updating, and deleting files, by bypassing the authentication controls in the Files API.

Recommendation

  • Identify all instances of MomoTommy file-management-system in the environment.
  • Implement network-level access controls to restrict access to the application to trusted internal segments only.
  • Apply WAF rules to inspect HTTP requests directed at the 'app/Http/Controllers/FileController.php' logic if feasible.
  • Monitor application access logs for unexpected access to the Files API endpoints, particularly from unauthorized or external IP addresses.
]]>highadvisory