by Kastro
Paper/Archive/CVE-2026-72593

CVE-2026-72593

dulldusk phpfm — dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.3.563 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.

Affected

ProductAffectedFixed inSource
phpfm≤ 1.8.0–CNA

Scores by source

TuranSec (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupgithub.com/dulldusk/phpfmwriteupgithub.com/dulldusk/phpfm/blob/master/index.php