CVE-2026-111652

Versions of Engineercms through 2.0.5 are vulnerable to a missing authorization flaw in AttachController.Attachment . This vulnerability allows unauthenticated attackers to download project image and video attachments (specifically .jpg , .png , .bmp , and .mp4 files) by requesting known or deriv...