CVE-2026-8133: zyx0814 FilePress SQL Injection Vulnerability

CVE-2026-8133 Overview

CVE-2026-8133 is a SQL injection vulnerability in zyx0814 FilePress versions up to 2.2.0. The flaw resides in the Shares Filelist API exposed by dzz/shares/admin.php, where the order GET parameter is concatenated into a SQL ORDER BY clause without sufficient validation. An unauthenticated remote attacker can manipulate the order argument to inject arbitrary SQL fragments. The exploit has been disclosed publicly. The maintainer published patch commit e20ec58414103f781858f2951d178e19b1736664 to remediate the issue. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Unauthenticated remote attackers can inject SQL queries through the order parameter of the Shares Filelist API, exposing or manipulating database contents.

Affected Products

zyx0814 FilePress versions up to and including 2.2.0
Component: Shares Filelist API (dzz/shares/admin.php)
Component: Shares AJAX endpoint (dzz/shares/ajax.php)

Discovery Timeline

2026-05-08 - CVE-2026-8133 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-8133

Vulnerability Analysis

The vulnerability exists in the Shares Filelist API handler in dzz/shares/admin.php. The handler accepts an order GET parameter intended to control sort direction (asc or desc). Before the patch, the code applied trim() and a non-strict in_array() check against the allowed values. PHP's loose comparison combined with case-insensitive matching failed to reject crafted payloads, allowing an attacker-controlled string to flow into the assembled ORDER BY $orderby $order SQL fragment. The same pattern existed in dzz/shares/ajax.php. The endpoint requires no authentication, so exploitation is reachable over the network without prior credentials.

Root Cause

The root cause is improper input validation on the order parameter prior to its inclusion in a dynamically built SQL string. The pre-patch check if(!in_array($order, array('desc', 'asc'))) performed loose comparison and did not normalize input case, which is insufficient to enforce an allowlist when the value is later interpolated into a raw SQL statement.

Attack Vector

An unauthenticated remote attacker issues an HTTP GET request to the Shares Filelist API with a crafted order query parameter. Because the value is concatenated into the ORDER BY clause, the attacker can append SQL syntax such as boolean expressions, UNION subqueries, or time-based payloads to extract or modify data. No user interaction is required.

php

// Patch from commit e20ec58414103f781858f2951d178e19b1736664
// File: dzz/shares/admin.php (and dzz/shares/ajax.php)
         $start = $start+$perpage - $limit;
         $perpage = $limit;
     }
-    $order = isset($_GET['order']) ? trim($_GET['order']) : 'desc';
-    if(!in_array($order, array('desc', 'asc'))) $order = 'desc';
+    $order = isset($_GET['order']) ? strtolower(trim($_GET['order'])) : 'desc';
+    if(!in_array($order, array('desc', 'asc'), true)) $order = 'desc';
     $orderby = isset($_GET['orderby']) ? trim($_GET['orderby']) : 'dateline';
     if(!in_array($orderby,array('dateline'))) $orderby = 'dateline';
     $ordersql="order by $orderby $order";
// Source: https://github.com/zyx0814/FilePress/commit/e20ec58414103f781858f2951d178e19b1736664

The fix normalizes the input with strtolower() and enforces strict type comparison in in_array() to prevent type-juggling bypasses.

Detection Methods for CVE-2026-8133

Indicators of Compromise

HTTP GET requests to paths matching dzz/shares/admin.php or dzz/shares/ajax.php containing order= values other than asc or desc.
Query strings carrying SQL syntax such as SLEEP(, UNION SELECT, BENCHMARK(, comment sequences (--, #), or hex-encoded payloads in the order parameter.
Database error responses or anomalously long response times correlated with requests against the Shares API.

Detection Strategies

Inspect web server access logs for the Shares Filelist endpoints and alert on order parameter values not matching the strict allowlist {asc, desc}.
Deploy WAF signatures that match common SQL injection patterns on parameters bound to ORDER BY clauses.
Correlate database slow-query or error logs with web requests targeting dzz/shares/admin.php to surface blind injection attempts.

Monitoring Recommendations

Forward HTTP access logs and database error logs to a centralized analytics platform for cross-source correlation.
Track baseline request volume to Shares API endpoints and alert on volumetric spikes from single source IPs, which may indicate automated exploitation.
Monitor for outbound connections from the FilePress host that may indicate post-exploitation data exfiltration.

How to Mitigate CVE-2026-8133

Immediate Actions Required

Apply patch commit e20ec58414103f781858f2951d178e19b1736664 from the zyx0814 FilePress repository to all affected installations.
Restrict network access to the FilePress administrative paths to trusted IP ranges until patching is complete.
Audit database logs for prior exploitation attempts targeting the order parameter on the Shares API.

Patch Information

The upstream fix is delivered in commit e20ec58414103f781858f2951d178e19b1736664 and merged via pull request #71. The patch updates both dzz/shares/admin.php and dzz/shares/ajax.php to normalize the order value with strtolower() and enforce strict allowlist matching via in_array($order, array('desc', 'asc'), true). Additional context is available in issue #70 and the VulDB entry.

Workarounds

Place a reverse-proxy or WAF rule in front of FilePress that rejects requests to dzz/shares/admin.php and dzz/shares/ajax.php when the order parameter is not exactly asc or desc.
Apply database-level least-privilege controls so the FilePress service account cannot read or modify sensitive tables outside its required scope.
Disable the Shares feature if it is not used in your deployment.

bash

# Example NGINX rule to enforce the order parameter allowlist
location ~ ^/dzz/shares/(admin|ajax)\.php$ {
    if ($arg_order !~* "^(asc|desc)?$") {
        return 400;
    }
    # pass to PHP-FPM as normal
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}