CVE-2026-114253: File Inclusion in oretnom23 file-management-system-php

This vulnerability exists in the oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The include function in index.php improperly handles the 'page' argument, allowing an attacker to perform file inclusion remotely. The product uses a rolling release approach, so no specific affected or fixed versions are identified. The issue was reported early to the project, but no official fix or response has been provided. The CVSS 4.0 base score is 5.3, indicating medium severity.

Successful exploitation allows an attacker to include arbitrary files remotely, which can lead to information disclosure or code execution depending on the included content. The vulnerability is remotely exploitable without privileges or user interaction, but the overall impact is limited to low confidentiality, integrity, and availability impacts as per the CVSS vector.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting access to the vulnerable parameter or applying manual input validation to mitigate exploitation risk until an official fix is released.