CVE-2026-72593

Name of the Vulnerable Software and Affected Versions dulldusk/phpfm versions prior to 1.8.1

Description A missing authentication flaw allows an unauthenticated remote attacker to access the full file manager functionality. This enables the reading, writing, deleting, and uploading of files anywhere on the server filesystem. The issue occurs because the authentication check in the index.php file evaluates the condition if ($auth pass == '' || $loggedon==$auth pass). In the default configuration, auth pass is an empty string, causing the condition to always evaluate to true and grant full access without credentials.

Recommendations Update dulldusk/phpfm to a version newer than 1.8.0.