CVE-2026-119657 FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119657?
CVE-2026-119657 is a low-severity vulnerability in zyx0814 FilePress, published on 30 Oct 2026.
Official description
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
Weakness: CWE-639
Which versions are affected by CVE-2026-119657?
How do I fix CVE-2026-119657?
No fix has been published for CVE-2026-119657 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119657 being exploited?
There is no known exploitation of CVE-2026-119657 in the wild and no public exploit code.
Sources
Also known as GHSA-6vrq-vfh4-v7v2.