CVE-2026-114262: Unrestricted Upload in file-management-system

This vulnerability in file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) affects the store function of app/Http/Controllers/FileController.php. Improper validation or restrictions on the File argument allow an attacker to upload arbitrary files without restriction. The vulnerability is remotely exploitable without privileges or user interaction. The product's rolling release model means no fixed version numbers are provided. The vendor has not responded to the issue report, and no official patch or remediation guidance is available. The CVSS 4.0 base score is 6.9, indicating medium severity. Public exploit details have been disclosed, but no active exploitation is confirmed.

Successful exploitation allows an unauthenticated remote attacker to upload arbitrary files to the system, potentially leading to unauthorized file storage or code execution depending on the environment. The vulnerability does not require user interaction or privileges. The medium CVSS score reflects the significant risk of unauthorized file upload but with limited confirmed impact details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates. As a temporary measure, restricting file upload permissions and implementing manual validation or filtering on uploaded files may reduce risk.