PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114257 oretnom23 CVE debrief

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The vulnerability is located in the function readfile of the file download.php of the component File Download. This vulnerability allows for sql injection through manipulation of the argument ID. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vendor
oretnom23
Product
file-management-system-php
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-23
Advisory published
2026-10-21
Advisory updated
2026-10-23

Who should care

Defenders and administrators of systems using oretnom23 file-management-system-php should assess their exposure and potential impact, and prioritize verification and potential remediation.

Why it matters

This sql injection vulnerability in oretnom23 file-management-system-php can be exploited remotely and may allow attackers to manipulate the database. Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact.

  • Verify sql injection vulnerability presence and potential impact
  • Assess remote exploitability and potential attack vectors
  • Consider applying patches or workarounds if available
  • Monitor systems for potential exploitation attempts

Technical summary

The vulnerability is located in the readfile function of download.php in the File Download component of oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. It allows for sql injection through manipulation of the argument ID and can be exploited remotely. Affected product deployments should be identified and assessed for potential impact. Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact, as it is a sql injection vulnerability that can be exploited remotely.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and assessing the potential impact, as it is a sql injection vulnerability that can be exploited remotely.

Recommended defensive actions

  • Verify the presence of this vulnerability in your systems
  • Assess the potential impact of this vulnerability
  • Consider applying patches or workarounds if available
  • Monitor systems for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability, including its location in the readfile function of download.php and the potential for sql injection. However, the corpus does not establish versions beyond 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114257 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114257

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114257 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114257

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • oretnom23 file-management-system-php File Download download.php readfile sql injection

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114257.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/424689

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/424689/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-114257

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1018609

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/oretnom23/file-management-system-php/issues/5

    Supplemental source - exploit, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/oretnom23/file-management-system-php/

    Supplemental source - product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.