Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-111652: Engineercms 2.0.5 lets anyone download project images and videos

CVE-2026-111652 · published 19 days ago

Summary

The AttachController in Engineercms versions up to 2.0.5 does not check who is requesting files, so anyone on the internet can pull down attached pictures or video files by guessing the URL. This could expose confidential project media. Update to a patched version or block direct access to the /attachment/ path until the software is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
3xxx	engineercms	<= 2.0.5

Original advisory text

Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.

References

https://github.com/3xxx/engineercms/blob/v2.0.5/controllers/attachment.go#L1705-... Third Party Advisory
https://github.com/3xxx/engineercms Product
https://hackmd.io/@hieuPenguinnn/engineercms-attachment-image-mp4-missing-authz Vendor Advisory
https://www.vulncheck.com/advisories/engineercms-through-2.0.5-missing-authoriza... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1116... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-111652 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published16 Oct 2026

Updated4 Nov 2026

First seen16 Oct 2026

Sources

CVE-2026-111652 · NVD

CVE-2026-111652 · MITRE

CVE-2026-111652 · OSV

Track software like this

Free during beta