CVE-2026-95500

40th percentile - higher than 40% of all known CVEs

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

An attacker can remotely upload arbitrary files, potentially leading to code execution, data tampering, or server compromise. The publicly available exploit increases the risk of rapid exploitation.

Given the vendor's lack of response, consider disabling or removing the vulnerable component and enforcing access controls and upload validation. Monitor logs for unauthorized uploads.