CVE-2026-111652

5.3 Moyenne

Publiée le 16/10/2026 à 20:17 · Modifiée le 16/10/2026 à 22:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.

Traduire en français

Produits concernés

3xxx engineercms

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/3xxx/engineercms
https://github.com/3xxx/engineercms/blob/v2.0.5/controllers/attachment.go#L1705-L1706
https://hackmd.io/@hieuPenguinnn/engineercms-attachment-image-mp4-missing-authz
https://www.vulncheck.com/advisories/engineercms-through-2.0.5-missing-authorization-via-attachcontroller-attachment
https://hackmd.io/@hieuPenguinnn/engineercms-attachment-image-mp4-missing-authz

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories