CVE-2026-72592

Name of the Vulnerable Software and Affected Versions dulldusk/phpfm versions prior to 1.8.1

Description An unrestricted file upload issue allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application is configured by default with an empty upload extension filter upload ext filter and no authentication enabled via the auth pass variable. This allows an attacker to upload a PHP webshell and execute it by accessing the uploaded file path.

Recommendations Update dulldusk/phpfm to a version later than 1.8.0. Configure the upload ext filter to restrict allowed file extensions. Set a strong password for the auth pass variable to enable authentication.