CVE-2026-72592
Received Received - Intake

Unrestricted File Upload in phpFM

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72592
EUVD
EUVD-2026-55214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dulldusk phpfm 1.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in dulldusk/phpfm version 1.8.0 or earlier. It allows unauthenticated remote attackers to upload and execute arbitrary PHP code on the server. The application has no file upload restrictions and no default authentication, making it easy for attackers to upload malicious PHP files and run them by accessing the file path.

Detection Guidance

Check for unauthorized PHP files in web directories, especially in the phpfm installation path. Look for files with .php extensions that were uploaded recently. Inspect server access logs for unusual POST requests to /index.php or file upload endpoints. Use commands like 'find /var/www -name "*.php" -type f -mtime -7' to find recently modified PHP files.

Impact Analysis

An attacker could exploit this to take full control of the server by uploading and executing malicious PHP code. This could lead to data theft, defacement, installation of malware, or use of the server for further attacks. The high CVSS score (9.8) indicates severe impact including confidentiality, integrity, and availability loss.

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR (data protection) and HIPAA (health data security) due to unauthorized access and potential data breaches. Organizations using this software without proper authentication or file upload restrictions risk non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Immediately restrict access to the phpfm application by setting a strong password in auth_pass. Update phpfm to the latest version if available. Disable file upload functionality if not required. Monitor server logs for signs of exploitation and remove any unauthorized PHP files found.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart