CVE-2026-114257: SQL Injection in oretnom23 file-management-system-php

This vulnerability exists in the oretnom23 file-management-system-php in the readfile function of download.php within the File Download component. By manipulating the ID argument, an attacker can perform SQL injection remotely. The product's rolling release model means version information for affected or patched releases is not provided. The vulnerability was responsibly disclosed but remains unpatched as of the report date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to perform SQL injection via the ID parameter in the download.php file, potentially leading to unauthorized database access or manipulation. The CVSS score of 6.9 indicates a medium severity impact with partial impact on confidentiality, integrity, and availability. No known active exploitation in the wild has been reported.

No official fix or patch has been released yet. Users should monitor the vendor's communications for updates. Until a patch is available, consider restricting access to the vulnerable functionality or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in download.php.