Is CVE-2026-114258 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114258 being exploited in the wild.

How severe is CVE-2026-114258?

High severity, with a CVSS score of 7.3, published 21 October 2026.

Which products and versions are affected?

Oretnom23 File-Management-System-Php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4.

How is CVE-2026-114258 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114258?

Check whether you run Oretnom23 File-Management-System-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114258: oretnom23 file-management-system-php SQL injection in file operations

CVE-2026-114258 · Severity: high · CVSS 7.3 · Published 2026-10-21

A file management system for sharing and organizing documents contains unauthenticated SQL injection vulnerabilities in its file handling components. An attacker can remotely inject malicious SQL code through file ID parameters to extract sensitive database information, including usernames and database names, without requiring authentication.

Technologies: Oretnom23 File-Management-System-Php. Vendors: Oretnom23.

Quick answers

Is CVE-2026-114258 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114258 being exploited in the wild.
How severe is CVE-2026-114258?: High severity, with a CVSS score of 7.3, published 21 October 2026.
Which products and versions are affected?: Oretnom23 File-Management-System-Php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4.
Is there a fix for CVE-2026-114258?: No fixed version is recorded yet. Use prepared statements or parameterized queries for all database operations, and implement input validation and sanitization for all GET/POST parameters. Apply HTML entity encoding to all output before rendering in web pages.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-114258 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114258?: Check whether you run Oretnom23 File-Management-System-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements or parameterized queries for all database operations, and implement input validation and sanitization for all GET/POST parameters. Apply HTML entity encoding to all output before rendering in web pages.</anigation> </invoke>

Technical details

SQL injection exists in files.php, manage_files.php, manage_folder.php, and manage_user.php where GET parameters (fid, id) are directly concatenated into SQL queries without prepared statements or input validation. Unauthenticated attackers can bypass the session check in index.php and inject UNION SELECT statements to read arbitrary data from the database. The vulnerability is remotely exploitable and has a public proof-of-concept.

Affected products

oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4

Timeline

2026-10-21: disclosed
2026-10-07: other: Issue reported on GitHub, project has not responded

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.