CVE-2026-72593CWE-306

CVE-2026-72593

Critical · published August 10, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00790 · 55.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-10T15:17Z
References (2)
https://github.com/dulldusk/phpfm · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/dulldusk/phpfm/blob/master/index.php · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 10 AUG 10:41Z
    dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access
    cvelistv5