Missing Authentication in MomoTommy File Management System
CVE-2026-114261

6.9MEDIUM

Key Information:

Vendor

Momotommy

Status
File-management-system
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-114261?

A missing authentication vulnerability exists in the MomoTommy file-management-system, specifically within the Files API. The flaw is located in the FileController.php of the component responsible for managing file operations. An attacker could take advantage of this vulnerability to manipulate the request arguments, allowing access to functions such as index, store, update, and destroy without proper authentication. This vulnerability is particularly concerning as the exploit can be executed remotely, intensifying the risk. While the project was alerted about this issue via an issue report, there has been no acknowledgment or action taken to address the vulnerability.

Affected Version(s)

file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-114261 - Proof of Concept

References

https://vuldb.com/vuln/424693
vdb-entrytechnical-description
https://vuldb.com/vuln/424693/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-114261
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

wukong1233333333 (VulDB User)
VulDB CNA Team
.