3xxx CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM 3xxx CVE published 2026-10-16

CVE-2026-111652

CVE-2026-111652 is a missing authorization vulnerability in Engineercms through version 2.0.5, specifically in the AttachController.Attachment component. This vulnerability allows unauthenticated attackers to download project image and video attachments by requesting known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.