CVE-2026-114258: SQL Injection in oretnom23 file-management-system-php

This vulnerability in oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 allows remote attackers to perform SQL injection by manipulating the fid/id parameter in the files.php file management component. The issue is confirmed and publicly disclosed with a CVSS 4.0 base score of 6.9 (medium severity). Due to the rolling release nature of the product, no explicit version numbers for affected or fixed releases are available. The vendor has been informed but has not responded or issued a fix.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the fid/id parameter. This could lead to unauthorized data access or modification. The CVSS vector indicates low complexity and no privileges or user interaction required, but the impact on confidentiality, integrity, and availability is limited to low or limited scope.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's project for updates and consider applying any future patches promptly. Until a fix is released, restricting access to the affected component or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the fid/id parameter may help mitigate risk.