CVE-2026-72593
Received Received - Intake

Unauthenticated File Access in phpFM

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72593
EUVD
EUVD-2026-55163

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dulldusk phpfm 1.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a missing authentication vulnerability in the dulldusk/phpfm file manager software up to version 1.8.0. It allows unauthenticated remote attackers to bypass authentication and gain full access to file manager functions including reading, writing, deleting, and uploading files anywhere on the server filesystem.

Detection Guidance

Check if dulldusk/phpfm version 1.8.0 or earlier is installed. Inspect index.php for the authentication check condition 'if ($auth_pass == '' || $loggedon==$auth_pass)'. Look for unauthorized file access or modifications in the server filesystem.

Impact Analysis

An attacker could exploit this to steal sensitive data, modify or delete critical files, upload malicious files, or gain control of the server. This could lead to complete system compromise, data breaches, or service disruption.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data. Exploitation could result in unauthorized data exposure, leading to regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade dulldusk/phpfm to a version that fixes the missing authentication vulnerability. Remove or restrict access to the vulnerable index.php file. Implement strong authentication mechanisms and monitor for unauthorized file changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72593. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart