CVE-2026-95500: JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction, according to the supplied vector. Public exploit disclosure means attempted exploitation should be considered plausible.
Which releases are known to be affected?
JosephChuks php-file-manager-with-code-editor versions up to and including 3.0 are identified as impacted. No fixed version is provided in the available data.
What is the security impact of a successful exploit?
Manipulation of the filename and content passed to codeEditor.php can result in unrestricted file upload. The supplied severity vector indicates low impacts to confidentiality, integrity, and availability.
Did the vendor provide a response or remediation?
The vendor was contacted before disclosure but did not respond. The available information does not identify a vendor patch or workaround.