CVE-2026-114261 | MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df Files API FileController.php index/store/update/destroy request missing authentication

October 21, 2026 Yanac

A vulnerability, which was classified as critical, was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication.

This vulnerability is reported as CVE-2026-114261. The attack can be launched remotely. Moreover, an exploit is present.

This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More