CVE-2026-119657

EUVD-2026-114073
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/zyx0814/FilePress
https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30
https://github.com/zyx0814/FilePress/issues/76
https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idor
https://www.vulncheck.com/advisories/filepress-through-3.0.1-missing-authorization-in-pichome-library-folder-operations