CVE-2026-119657

FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations

State: Published
Severity: 2.3 Low
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 30, 2026

Description

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	VulnCheck

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
FilePresszyx0814	3.0.1 and earlierAffected

References

https://github.com/zyx0814/FilePress/issues/76issue-tracking
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9technical-description
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50technical-description
https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30technical-description
https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64technical-description
https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idorthird-party-advisory
https://github.com/zyx0814/FilePressproduct
VulnCheck Advisory: FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operationsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.