CVE-2026-95499 in php-file-manager-with-code-editor
Summary
by MITRE • 09/22/2026
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in JosephChuks php-file-manager-with-code-editor versions up to 3.0 represents a critical security flaw rooted in the improper handling of file uploads within the application's core functionality. Specifically, the defect resides in the move_uploaded_file function located in the filemanager.php script. This PHP function is designed to move an uploaded file from the temporary directory to a destination folder, but its implementation fails to enforce adequate validation or sanitization checks on the input arguments provided by the user. When an attacker manipulates the files argument passed to this function, they can bypass intended restrictions and achieve unrestricted file upload capabilities. This type of flaw is classically categorized under CWE-434, which describes the ability to upload dangerous types of files that may be executed by a web server or interpreted by client-side scripts if not properly restricted.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of unrestricted uploads in web applications. An attacker can leverage this flaw to upload malicious payloads, such as PHP shells, backdoors, or other executable code, directly onto the target server's file system. Once these files are uploaded and accessible via a predictable URL path, they allow for arbitrary command execution on the host machine. This effectively compromises the confidentiality, integrity, and availability of the underlying system. The attacker gains persistent access to the environment, potentially leading to full system compromise, data exfiltration, or use as a pivot point for further attacks against internal networks. Such scenarios align with MITRE ATT&CK techniques related to Initial Access via Web Application Exploitation and Execution through Command and Scripting Interpreter, highlighting the direct path from vulnerability exploitation to complete control over the affected infrastructure.
The severity of this issue is compounded by the vendor's lack of response despite early notification regarding the disclosure. In enterprise environments or public-facing deployments relying on open-source tools like php-file-manager-with-code-editor, the absence of a patch leaves users exposed indefinitely unless they implement their own compensating controls. The reliance on unpatched third-party components introduces significant supply chain risk and operational uncertainty for administrators who depend on this tool for file management tasks. Without an official fix from the vendor, organizations must assume that all instances running version 3.0 or earlier are vulnerable to remote code execution via file upload manipulation.
To mitigate this vulnerability in the absence of a vendor patch, immediate remediation steps should focus on restricting access and enforcing strict input validation at multiple layers. Administrators should restrict access to the filemanager.php endpoint using strong authentication mechanisms and IP whitelisting if possible, ensuring that only authorized personnel can interact with the file management interface. Additionally, implementing server-side configuration changes is critical; this includes disabling script execution in directories where uploaded files are stored by configuring web servers like Apache or Nginx to ignore PHP tags within those specific paths. Deploying a Web Application Firewall (WAF) can also help detect and block requests containing suspicious patterns associated with file upload exploits, such as encoded shell code or unusual file extensions. Furthermore, organizations should consider replacing this vulnerable component with a more secure alternative that adheres to modern security standards and receives active maintenance support from its developers. Regular auditing of uploaded files for malicious content using antivirus solutions or sandboxing techniques can provide an additional layer of defense against potential exploitation attempts.