CVE-2026-111619
CVE-2026-111619 · FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
This page contains facts from public vulnerability sources. Check the original advisory before updating.
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
CVSS 7.1 · High · EPSS 0.4%
- Published
- Updated
Affected products and versions
filepress
- Versions
- ≥ 0, ≤ 3.0.1: Affected (custom)
No fix published
Original sources
- https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqli
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L93
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L594-L642
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/collection/filelist.php#L453-L496
- https://github.com/zyx0814/FilePress
- https://www.vulncheck.com/advisories/filepress-through-3.0.1-sql-injection-via-asc-parameter-in-filelist-php
- https://nvd.nist.gov/vuln/detail/CVE-2026-111619