CVE-2026-95499: JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
JosephChuks php-file-manager-with-code-editor versions up to and including 3.0 are affected. The vulnerable behavior is in the move_uploaded_file functionality in filemanager.php.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the files argument. No authentication or user interaction requirements are identified in the provided severity vector.
Is a vendor fix available?
The provided data does not identify a fixed version or vendor remediation. It states that the vendor was contacted but did not respond.