CVE-2026-119657

CVSS 5.0 (medium) · published 2026-10-30

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

Weakness: CWE-639

Source: NVD CVE-2026-119657

References

• https://github.com/zyx0814/FilePress
• https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64
• https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9
• https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50
• https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30
• https://github.com/zyx0814/FilePress/issues/76
• https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idor
• https://www.vulncheck.com/advisories/filepress-through-3.0.1-missing-authorization-in-pichome-library-folder-operations

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.