Executive brief
phpFileManager is a PHP-based filesystem management tool deployed as a single file for server administration and rapid file access. A critical vulnerability allows unauthenticated attackers to upload and execute arbitrary PHP code on the server, because the application ships with file upload filtering disabled and authentication disabled by default, enabling complete server compromise.
Technical details
The vulnerability is an unrestricted file upload flaw in phpfm through version 1.8.0. The application initializes with an empty upload extension filter (defined as an empty array) and no authentication required by default (auth_pass is set to an empty string). An unauthenticated attacker can directly upload a PHP webshell through the upload functionality and then execute it by accessing the uploaded file path via HTTP, achieving arbitrary remote code execution with the privileges of the web server process. No patch is mentioned as available.
Affected products
- dulldusk phpfm through 1.8.0
Timeline
- 2026-08-10: disclosed