PT-2026-38656 · Filepress · Filepress

Xyhackr · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-8133

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zyx0814 FilePress versions prior to 2.2.1

Description An issue exists in the Shares Filelist API within the file 'dzz/shares/admin.php'. Manipulation of the argument order allows a remote attacker to perform SQL injection, which is a technique where malicious SQL statements are inserted into entry fields for execution to manipulate a database.

Recommendations Apply patch e20ec58414103f781858f2951d178e19b1736664 to remediate the issue.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-8133

Affected Products

Filepress

References · 13

• 🔥 https://github.com/xiaohaiyang-ai/Web-Security-Research/tree/main/FilePress/Shares-API-PreAuth-SQLi · Exploit
• https://github.com/zyx0814/FilePress/commit/e20ec58414103f781858f2951d178e19b1736664 · Patch
• https://github.com/zyx0814/FilePress/pull/71 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8133 · Security Note
• https://github.com/zyx0814/FilePress/issues/70 · Note
• https://t.me/CVEtracker/53068 · Telegram Post
• https://vuldb.com/vuln/361923/cti · Note
• https://github.com/zyx0814/FilePress · Note
• https://twitter.com/VulmonFeeds/status/2052719665751699714 · Twitter Post
• https://vuldb.com/vuln/361923 · Note
• https://twitter.com/CVEnew/status/2053174714504208695 · Twitter Post
• https://vuldb.com/submit/808819 · Note
• https://twitter.com/infoflowcloud/status/2053175962695602607 · Twitter Post