CVE-2026-72593 in phpfm
Summary
by MITRE • 08/10/2026
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. The authentication check in index.php at line 637 evaluates 'if ($auth_pass == '' || $loggedon==$auth_pass)', and since auth_pass is an empty string in the default configuration, the condition always evaluates to true and grants full access without credentials.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authentication bypass flaw in the dulldusk/phpfm file manager application through version 1.8.0, classified under CWE-287 which addresses improper authentication mechanisms. The vulnerability stems from a fundamental design flaw in the authentication validation logic within the index.php file at line 637 where the system performs a check that evaluates to true when the $auth_pass variable is empty. This default configuration scenario creates an inherent security weakness that allows any unauthenticated remote attacker to gain complete administrative access to the file management functionality without providing any credentials.
The technical implementation of this vulnerability exploits a logical error in the conditional statement structure where the system checks if $auth_pass equals an empty string or if $loggedon matches $auth_pass. In the default installation, $auth_pass is initialized as an empty string, causing the first condition to always evaluate to true regardless of whether legitimate authentication has occurred. This flaw demonstrates poor secure coding practices and violates fundamental security principles by not properly validating user credentials before granting access to sensitive system resources.
The operational impact of this vulnerability is severe and encompasses complete compromise of the affected server environment. An attacker can execute arbitrary file operations including reading sensitive files, writing malicious code, deleting critical system files, and uploading new files anywhere within the server filesystem. This level of access enables attackers to establish persistent backdoors, exfiltrate confidential data, modify system configurations, and potentially escalate privileges to gain deeper control over the underlying infrastructure. The vulnerability affects all installations using the default configuration without proper authentication setup.
Organizations should immediately implement mitigations including setting a strong password in the $auth_pass variable within the application configuration, disabling the file manager functionality if not required, and implementing network-level access controls to restrict access to the affected application. Additionally, deploying web application firewalls and monitoring for suspicious file operations can help detect potential exploitation attempts. This vulnerability aligns with ATT&CK technique T1566 which covers credential harvesting through various means including default credentials and authentication bypass methods. Regular security audits and proper configuration management practices are essential to prevent such issues from occurring in production environments, particularly when dealing with web-based administrative interfaces that require robust authentication mechanisms to protect against unauthorized access attempts.