SZB-df2fe79c4e
EUVD-2026-114073 reports missing authorization in FilePress library folders
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- zyx0814
- Product
- FilePress
- First seen
Summary
The EUVD entry, shared on Mastodon, says FilePress through 3.0.1 has a missing authorization flaw that lets authenticated users manage other libraries' folders. It assigns a CVSS v3.1 score of 2.3 and attributes the flaw to checkuserperm_by_uid checking only library membership.
If you use zyx0814
Check the zyx0814 FilePress project for a fixed release and upgrade past 3.0.1
Review library memberships and folder changes for unexpected activity
What the sources say 1
· Mastodon: “FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library.” Source