CVE-2026-72592 in phpfm
Summary
by MITRE • 08/10/2026
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ($upload_ext_filter = array()) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical security flaw in the dulldusk/phpfm application version 1.8.0 and earlier, where unrestricted file upload capabilities create a pathway for remote code execution. The flaw stems from the application's default configuration where the upload extension filter is initialized as an empty array, effectively disabling any validation of uploaded file extensions. This configuration, combined with the absence of authentication mechanisms since auth_pass is set to an empty string by default, creates an exploitable condition that allows unauthenticated attackers to bypass security controls entirely.
The technical implementation of this vulnerability leverages the application's lack of input validation and access control measures. When an attacker uploads a file without proper extension filtering, they can submit PHP code within a file name that appears benign but actually contains malicious executable code. The empty $upload_ext_filter array means no restrictions are applied to determine which file types are acceptable for upload, allowing any file type including executable php scripts to be uploaded successfully. This fundamental flaw in the application's security architecture directly violates the principle of least privilege and input validation, creating a direct pathway for arbitrary code execution.
The operational impact of this vulnerability is severe as it provides attackers with complete control over the affected server. Once a malicious PHP webshell is uploaded, the attacker can execute commands on the server with the privileges of the web application user. This allows for data exfiltration, system enumeration, privilege escalation, and potential lateral movement within the network. The default insecure configuration means that any system running this vulnerable version is immediately at risk without requiring any authentication credentials or advanced exploitation techniques. The vulnerability essentially transforms a legitimate file upload feature into a backdoor mechanism for persistent access.
Mitigation strategies must address both the immediate configuration issues and implement proper security controls. Organizations should immediately configure the auth_pass parameter to a strong, non-empty value to enable authentication mechanisms. The $upload_ext_filter array must be populated with a whitelist of allowed file extensions rather than leaving it empty. Implementing additional security layers such as file type detection, content validation, and mandatory file extension checking through server-side configurations or application-level filters provides defense in depth. According to CWE standards, this vulnerability maps directly to CWE-434 which covers unrestricted upload of file with dangerous type, while the ATT&CK framework categorizes this under T1190 for Exploit Public-Facing Application and T1059 for Command and Scripting Interpreter. Regular security audits should verify that default configurations are not left in place and that all uploaded files undergo proper validation before execution or storage.