CVE-2026-56124: phpUploader Information Disclosure Flaw

CVE-2026-56124 Overview

CVE-2026-56124 is an unauthenticated information disclosure vulnerability in phpUploader versions before 2.0.2. The index model executes an unbounded SELECT query against the uploaded-files database table. It then embeds the complete JSON-encoded result set inside an inline <script> block on every page of the application. Any remote attacker can visit the site and read the exposed metadata directly from the HTML source. Exposed fields include uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints. The issue is tracked under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can retrieve the full contents of the uploaded-files database table, including uploader IP addresses and Argon2ID password hashes, simply by loading any page of a vulnerable phpUploader instance.

Affected Products

phpUploader versions prior to 2.0.2
Fixed in phpUploader 2.0.2
Repository: shimosyan/phpUploader

Discovery Timeline

2026-06-29 - CVE-2026-56124 published to the National Vulnerability Database
2026-06-29 - Last updated in the NVD database

Technical Details for CVE-2026-56124

Vulnerability Analysis

The vulnerability resides in the Index model of phpUploader. The controller queries the uploaded-files table without column restrictions or authentication checks. It then passes the full result set to the view, which serializes it with json_encode and embeds it in a client-side window.fileData variable. Because the script tag is rendered on every page load, an unauthenticated attacker can extract sensitive metadata by issuing a single HTTP GET request and parsing the response body.

The exposed dataset includes Argon2ID key hashes used to protect uploaded files. An attacker can attempt offline cracking against these hashes to recover download keys. Uploader IP addresses expose user identity and enable targeted follow-on attacks. SHA-256 fingerprints and internal filenames may allow direct file retrieval when combined with predictable URL patterns.

Root Cause

The root cause is a design flaw combining two mistakes. First, the Index model selects all columns rather than a public subset. Second, the view emits the entire result set to the browser regardless of whether the fields should be publicly visible. There is no authorization check gating access to sensitive columns.

Attack Vector

Exploitation is trivial. An attacker sends an unauthenticated HTTP request to the phpUploader index page. The response contains an inline <script> block assigning the full database contents to window.fileData. Parsing the response yields all rows immediately with no interaction required.

php

// Vulnerable pattern in app/views/index.php (pre-2.0.2)
// The entire $data array — including private columns — is serialized to the browser
<script>
  window.fileData = <?php echo json_encode($data, JSON_UNESCAPED_UNICODE); ?>;
</script>

// Fixed pattern in phpUploader 2.0.2
class Index
{
    public const PUBLIC_FILE_COLUMNS = [
        'id',
        'origin_file_name',
        'comment',
        'size',
        'count',
        'input_date',
    ];
    // The model now restricts SELECT to PUBLIC_FILE_COLUMNS,
    // and the view hardens json_encode with JSON_HEX_* flags.
}

Source: GitHub Commit 45dc4f1

Detection Methods for CVE-2026-56124

Indicators of Compromise

HTTP GET requests to the phpUploader index page from unfamiliar IP ranges, especially from scanners or Tor exit nodes.
Web server access logs showing repeated requests to /index.php or the site root without any subsequent authenticated action.
Presence of window.fileData in outbound HTTP responses containing fields such as key_hash, ip, or hash.

Detection Strategies

Inspect responses from phpUploader deployments for inline <script> blocks that assign large JSON payloads to window.fileData.
Audit the running phpUploader version against the fixed release tag v2.0.2.
Correlate web access logs with database query logs to identify unbounded SELECT statements against the uploaded-files table.

Monitoring Recommendations

Alert on HTTP response bodies containing Argon2ID hash prefixes such as $argon2id$ in publicly served pages.
Track spikes in anonymous requests to the phpUploader root path from a single source IP.
Monitor for user-agent strings associated with automated content scrapers hitting the application.

How to Mitigate CVE-2026-56124

Immediate Actions Required

Upgrade phpUploader to version 2.0.2 or later without delay, using the release available at phpUploader v2.0.2.
Rotate any Argon2ID key hashes and force uploaders to regenerate download keys, since exposed hashes must be considered compromised.
Review web server logs for evidence of prior scraping and notify affected uploaders whose IP addresses may have been exposed.

Patch Information

The fix is delivered in phpUploader 2.0.2 via commit 45dc4f1c9a2de5ade427deebad0148834c0e8c50. The Index model now defines a PUBLIC_FILE_COLUMNS allow-list, restricting the SELECT query to non-sensitive columns. The view additionally hardens json_encode with JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT flags. See the VulnCheck advisory and the GitHub pull request discussion for full context.

Workarounds

If patching is not immediately possible, restrict access to the phpUploader application behind authentication at the web server or reverse proxy layer.
Apply a temporary WAF rule that strips or blocks responses containing window.fileData assignments referencing sensitive columns.
Manually modify app/models/index.php and app/views/index.php to mirror the upstream patch by limiting selected columns to non-sensitive fields.

bash

# Upgrade phpUploader to the patched release
cd /var/www/phpUploader
git fetch --tags
git checkout v2.0.2

# Verify the fix is in place
grep -n "PUBLIC_FILE_COLUMNS" app/models/index.php
grep -n "JSON_HEX_TAG" app/views/index.php