CVE-2026-72593
CriticalCVSS 9.8Summary
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. The authentication check in index.php at line 637 evaluates a condition that always returns true in the default configuration, granting full access without credentials.
Risk Assessment
The organization is at risk of complete server compromise, as an attacker can read, modify, and delete arbitrary files, potentially leading to data loss, confidentiality breaches, and system takeover.
Recommendation
Immediately update phpfm to the latest version or apply a patch, and configure a strong authentication password to prevent unauthorized access.
Original NVD description (English source)
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. The authentication check in index.php at line 637 evaluates 'if ($auth_pass == '' || $loggedon==$auth_pass)', and since auth_pass is an empty string in the default configuration, the condition always evaluates to true and grants full access without credentials.