Medium severity · published Oct 30, 2026
CVE-2026-119657
FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations
New
5.0
CVSS
–
EPSS
No
On KEV
Description
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FilePress · zyx0814
through 3.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119657
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119657
issue-tracking
https://github.com/zyx0814/FilePress/issues/76
technical-description
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9
technical-description
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50
technical-description
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30
technical-description
https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64
third-party-advisory
https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idor
More from FilePress
7.3
CVE-2026-90879
zyx0814 FilePress Publish search.php sql injection
7.3
CVE-2026-8133
zyx0814 FilePress Shares Filelist API admin.php sql injection
6.5
CVE-2026-111619
FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php