Executive brief
phpfm is a PHP-based file manager tool used for rapid server file access and administration. A missing authentication check allows unauthenticated attackers to bypass password protection and gain full file manager access, enabling them to read, modify, delete, and upload files anywhere on the server—potentially leading to complete server compromise and data theft.
Technical details
The vulnerability is a missing authentication check in phpfm through version 1.8.0 that fails to properly validate user credentials before granting access to file manager functionality. The vulnerable component is the main entry point (index.php), which does not enforce password authentication on all operations. An unauthenticated remote attacker can access the application over the network without providing credentials and perform unrestricted file operations including reading sensitive files, writing malicious code, deleting critical files, and uploading arbitrary files to the server filesystem. The vulnerability affects all versions through 1.8.0, and patches should be available in later releases.
Affected products
- dulldusk phpfm through 1.8.0
Timeline
- 2026-08-10: disclosed: CVE-2026-72593 published