CVE-2022-40797 in Fileman
Summary
by MITRE • 11/09/2022
Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability CVE-2022-40797 affects Roxy Fileman version 1.4.6, a web-based file manager application that provides users with the ability to upload, download, and manage files through a graphical interface. This particular flaw represents a critical security weakness that allows remote attackers to execute arbitrary code on the affected system. The vulnerability stems from an insufficient file upload restriction mechanism within the application's configuration, specifically within the default FORBIDDEN_UPLOADS setting located in the conf.json configuration file. The flaw is particularly dangerous because it leverages the inherent behavior of web servers that automatically invoke the PHP interpreter when encountering files with certain extensions, even when those files are not intended to be executed as PHP scripts.
The technical root cause of this vulnerability lies in the incomplete blacklist approach used for file type validation. The default configuration only blocks .php, .php4, and .php5 file extensions, leaving .phar files unblocked despite their potential to execute code when accessed through a web server. A .phar file is a PHP archive that can contain serialized PHP objects and executable code, making it a powerful tool for remote code execution attacks. When an attacker uploads a malicious .phar file through the Roxy Fileman interface and then accesses it via a web browser, the web server's PHP interpreter processes the file and executes any embedded code, providing the attacker with remote command execution capabilities on the target system. This vulnerability aligns with CWE-434, which describes "Unrestricted Upload of File with Dangerous Type," and demonstrates the dangers of relying solely on blacklisting approaches for file validation.
The operational impact of this vulnerability is severe and far-reaching, as it allows attackers to gain complete control over the affected web server. An attacker who successfully exploits this vulnerability can execute arbitrary commands, potentially leading to data theft, system compromise, or further lateral movement within the network. The attack vector is particularly concerning because it requires minimal privileges to execute, as the file manager is typically accessible to authenticated users who may have legitimate file management needs. This makes the vulnerability especially dangerous in environments where file managers are deployed with broad user access. The exploitability of this vulnerability is enhanced by the fact that many web server configurations will automatically process .phar files through the PHP interpreter, making it unnecessary for attackers to understand specific server configurations or employ complex attack techniques.
Mitigation strategies for this vulnerability should focus on implementing comprehensive file validation mechanisms that go beyond simple blacklisting approaches. Organizations should immediately update to the latest version of Roxy Fileman where this vulnerability has been patched, as the developers have addressed the issue by expanding the forbidden uploads list to include .phar files and other dangerous extensions. Additionally, administrators should implement a whitelist-based approach to file uploads, allowing only specific, known-safe file types rather than blocking dangerous ones. Network-level protections such as web application firewalls can provide additional layers of defense by monitoring and blocking suspicious file upload patterns. Security configurations should also include disabling automatic PHP interpretation of files with potentially dangerous extensions and implementing proper file access controls to prevent unauthorized execution of uploaded files. The ATT&CK framework categorizes this vulnerability under T1190, "Exploit Public-Facing Application," and T1059, "Command and Scripting Interpreter," highlighting the need for both application-level and network-level defenses to protect against such attacks.