CVE-2026-72592
CriticalCVSS 9.8Summary
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter and no authentication enabled by default, allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.
Risk Assessment
An attacker can gain full control of the server by executing arbitrary code, leading to system integrity compromise, data theft, and potential use of the server for further attacks.
Recommendation
Update phpfm to a patched version, enable authentication, and configure an allowed file extension list to prevent uploading executable files.
Original NVD description (English source)
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ($upload_ext_filter = array()) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.