CVE-2026-111619 zyx0814 CVE debrief

Who should care

Defenders responsible for FilePress installations, particularly in environments where low-privilege user accounts exist, should assess exposure and prioritize remediation. This includes verifying and remediating the vulnerability, implementing input validation and sanitization for the asc parameter, and monitoring for potential SQL injection attempts. Additionally, defenders should review compensating controls for exposed systems, check relevant monitoring

Why it matters

CVE-2026-111619 is a high-severity SQL injection vulnerability in FilePress through 3.0.1, allowing authenticated low-privilege users to inject SQL into ORDER BY clauses. Defenders should prioritize verifying and remediating this vulnerability, particularly in environments with low-privilege user accounts.

• Potential data extraction, including administrator credential hashes
• Possible lateral movement through SQL injection
• Required verification of FilePress installations and user account management
• Necessity for input validation and sanitization of the asc parameter

Technical summary

The SQL injection vulnerability in FilePress through 3.0.1 allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter in filelist.php and collection/filelist.php. This could potentially allow attackers to extract database rows, including administrator credential hashes. The vulnerability is particularly concerning in environments where low-privilege user accounts exist, as it could lead to unauthorized data access and potential lateral movement. Defenders should prioritize verifying and remediating this vulnerability in FilePress installations, particularly in environments with low-privilege user accounts.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in FilePress installations, particularly in environments where low-privilege user accounts exist.

Recommended defensive actions

• Verify FilePress installations and check for version 3.0.1 or earlier
• Restrict access to the filelist.php file
• Implement input validation and sanitization for the asc parameter
• Monitor for potential SQL injection attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in FilePress through 3.0.1. The vulnerability is in the filelist.php file, specifically in the asc parameter. The source item includes references to technical descriptions and potential exploit attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.