CVE-2026-90879 Overview
CVE-2026-90879 is a SQL injection vulnerability in zyx0814 FilePress up to version 3.0.1. The flaw resides in dzz/publish/search.php within the Publish Module. Attackers can manipulate the orderby and order request parameters to inject arbitrary SQL statements. The attack is executable remotely without authentication or user interaction. The exploit has been publicly disclosed and may be leveraged by opportunistic attackers. The FilePress project was notified through an issue report but has not published a fix at the time of disclosure. The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.
Critical Impact
Unauthenticated remote attackers can inject SQL through the orderby and order parameters, potentially disclosing or altering database contents in FilePress deployments.
Affected Products
- zyx0814 FilePress versions up to and including 3.0.1
- Component: Publish Module (dzz/publish/search.php)
- Deployments exposing the FilePress web interface to untrusted networks
Discovery Timeline
- 2026-09-15 - CVE-2026-90879 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90879
Vulnerability Analysis
The vulnerability is a SQL injection flaw affecting the FilePress Publish Module. The affected code path is dzz/publish/search.php, which processes user-supplied orderby and order parameters when building database queries. Because these values are concatenated into SQL statements without proper sanitization or parameterization, attackers can alter the query structure to read, modify, or exfiltrate database rows. The issue is remotely reachable and does not require authentication, which increases the population of vulnerable hosts exposed to opportunistic scanning. Public exploit details are available, lowering the barrier to weaponization by low-skill actors.
Root Cause
The root cause is improper neutralization of user input incorporated into SQL statements ([CWE-74]). Parameters intended to control result ordering, orderby and order, are typically difficult to protect using prepared statements because ORDER BY clauses cannot be parameterized directly. Developers must instead validate these values against an allow-list of known column names and sort directions. FilePress up to 3.0.1 does not perform this validation, allowing attacker-controlled strings to reach the database engine as executable SQL fragments.
Attack Vector
An unauthenticated remote attacker crafts an HTTP request to the search endpoint served by dzz/publish/search.php, supplying malicious payloads through the orderby or order query parameters. Payloads can include UNION-based selects, time-based blind injections, or stacked statements depending on the database driver and privileges. Successful exploitation yields access to underlying data stored by FilePress, including user records and file metadata. Automated scanners referencing the public exploit can identify vulnerable instances at scale.
No verified proof-of-concept code is included in this advisory. Refer to the GitHub FilePress Issue #74 and VulDB entry for CVE-2026-90879 for technical detail.
Detection Methods for CVE-2026-90879
Indicators of Compromise
- HTTP requests to dzz/publish/search.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the orderby or order parameters.
- Web server or application logs showing malformed values or encoded punctuation (for example %27, %2C, --) in ordering parameters.
- Database error messages or query timeouts correlating with search requests originating from external IP addresses.
Detection Strategies
- Deploy web application firewall rules that inspect the orderby and order parameters on FilePress endpoints for SQL syntax and reject non-allow-listed values.
- Enable database query logging and alert on unexpected queries against FilePress tables that include unusual column references or UNION operators.
- Correlate authentication-less HTTP requests to dzz/publish/search.php with subsequent spikes in database CPU or row read counts.
Monitoring Recommendations
- Baseline normal request patterns for the FilePress Publish Module and alert on deviations in parameter length, character class, or request rate.
- Forward web and database telemetry to a centralized SIEM for cross-source correlation of injection attempts and data-access anomalies.
- Track outbound connections from the FilePress host to detect exfiltration following a successful injection.
How to Mitigate CVE-2026-90879
Immediate Actions Required
- Restrict access to FilePress administrative and search endpoints using network ACLs, VPN, or reverse-proxy authentication until a patch is available.
- Deploy WAF signatures blocking SQL metacharacters in the orderby and order parameters on requests to dzz/publish/search.php.
- Audit database accounts used by FilePress and enforce least privilege, removing DDL and cross-database permissions where possible.
- Review web and database logs for prior exploitation attempts using the indicators listed above.
Patch Information
No vendor patch is available at the time of publication. The maintainer was notified through GitHub FilePress Issue #74 but has not responded. Monitor the FilePress repository for security releases and apply updates promptly once published.
Workarounds
- Implement a server-side allow-list that constrains orderby to known column names and order to ASC or DESC before the values reach the query builder.
- Place FilePress behind an authenticating reverse proxy so that the Publish Module is not reachable by unauthenticated internet users.
- Consider taking the Publish Module offline or removing dzz/publish/search.php from the deployment if the feature is not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.