CVE-2026-72593: dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set a non-empty value for $auth_pass in the dulldusk/phpfm default configuration so the condition in index.php (line 637: if ($auth_pass == '' || $loggedon==$auth_pass)) does not always evaluate to true.
dulldusk/phpfm (index.php) $auth_pass default configuration = non-empty
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72593?
CVE-2026-72593 has a critical severity score of 9.8.
How do I fix CVE-2026-72593?
To fix CVE-2026-72593, implement proper authentication mechanisms in the dulldusk/phpfm application.
What systems are affected by CVE-2026-72593?
CVE-2026-72593 affects version 1.8.0 of the dulldusk/phpfm application.
What type of attacks does CVE-2026-72593 allow?
CVE-2026-72593 allows unauthenticated remote attackers to perform full filesystem access operations.
What are the potential impacts of CVE-2026-72593?
The potential impacts of CVE-2026-72593 include unauthorized reading, writing, deleting, and uploading of files on the server.