CVE-2026-72593: phpfm Auth Bypass Vulnerability

CVE-2026-72593 Overview

CVE-2026-72593 is a missing authentication vulnerability in the dulldusk/phpfm PHP File Manager through version 1.8.0. The application exposes the full file manager interface without any authentication check. An unauthenticated remote attacker can read, write, delete, and upload files anywhere the PHP process has filesystem access. The flaw is categorized as CWE-306: Missing Authentication for a Critical Function. Because the application typically runs with web server privileges, an attacker can drop a webshell and achieve remote code execution on the host.

Critical Impact
Unauthenticated attackers can read, modify, delete, and upload arbitrary files across the server filesystem, enabling full host compromise through webshell upload.

Affected Products

dulldusk/phpfm (PHP File Manager) through version 1.8.0
Deployments exposing index.php from the phpfm project on any web server
Downstream forks and bundles that ship the vulnerable index.php unchanged

Discovery Timeline

2026-08-10 - CVE-2026-72593 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72593

Vulnerability Analysis

The phpfm project ships a single-file PHP application (index.php) that implements a browser-based file manager. The application handles operations such as directory listing, file read, file write, deletion, rename, and upload based on request parameters. All of this functionality is reachable through unauthenticated HTTP requests to the exposed script.

The file manager operates with the privileges of the PHP process, typically the web server user. This gives an attacker the same filesystem reach as the web application itself. On many deployments that is sufficient to overwrite application source, plant persistence, or exfiltrate configuration files containing database credentials.

References to the source and upstream repository are available at the phpfm GitHub repository and the index.php source.

Root Cause

The root cause is the absence of an authentication or authorization gate before executing privileged file operations. The project does not enforce a login, session token, or shared secret before dispatching request actions. Any request that reaches index.php is processed as an authorized administrative request. This maps directly to [CWE-306].

Attack Vector

Exploitation requires only network access to the exposed index.php endpoint. An attacker sends an HTTP request specifying the desired file operation and target path. Because there is no credential validation, the request executes with full file manager privileges. The most direct path to remote code execution is uploading a PHP file into a web-accessible directory and requesting it. Verified public exploitation code is not referenced in the CVE record; the technical mechanism is described above rather than through synthesized proof-of-concept code.

Detection Methods for CVE-2026-72593

Indicators of Compromise

HTTP requests to index.php containing file manager action parameters such as upload, delete, rename, or read operations from unexpected client IP addresses.
Creation or modification of .php, .phtml, or .phar files inside web-served directories where the application does not normally write.
New outbound connections initiated by the web server user immediately after file writes to the document root.
Presence of the phpfmindex.php file in production deployments where it is not an intentional administrative component.

Detection Strategies

Inventory web roots for the dulldusk/phpfmindex.php signature and flag any exposed instances.
Alert on POST requests to the file manager endpoint with multipart/form-data bodies from non-administrative source addresses.
Correlate file integrity monitoring events on the document root with preceding HTTP requests to index.php.
Hunt process trees where the web server user spawns shell interpreters (sh, bash, cmd.exe) or network tools (curl, wget, nc).

Monitoring Recommendations

Forward web server access logs and file integrity events into a centralized data lake for correlation across hosts.
Baseline normal write activity for each web root and alert on deviations from that baseline.
Track outbound network connections from PHP-FPM and Apache worker processes to identify post-exploitation callbacks.

How to Mitigate CVE-2026-72593

Immediate Actions Required

Remove dulldusk/phpfm from any internet-facing deployment until authentication is enforced.
Restrict access to the file manager endpoint using web server access controls, IP allowlists, or a reverse proxy with authentication.
Audit the document root for unauthorized .php files and unexpected modifications since the application was deployed.
Rotate any credentials, API keys, or tokens stored on the host, since an attacker with filesystem read access may have exfiltrated them.

Patch Information

No vendor patch is referenced in the NVD record for CVE-2026-72593 at the time of publication. The project is available at the phpfm GitHub repository. Operators should monitor the upstream repository for a fixed release and, in the interim, treat all deployments through version 1.8.0 as unauthenticated administrative interfaces.

Workarounds

Place the application behind an authenticating reverse proxy such as Nginx auth_basic or an identity-aware proxy.
Deny direct access to index.php at the web server layer and expose it only through an authenticated administrative VPN.
Run the PHP process under a dedicated low-privilege user with write access limited to a narrow directory to reduce blast radius if reintroduced.
Replace dulldusk/phpfm with a maintained file management solution that enforces authentication and role-based access control.

bash

# Example Nginx configuration restricting phpfm to an authenticated admin location
location = /index.php {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    allow 10.0.0.0/8;
    deny all;
    fastcgi_pass unix:/run/php/php-fpm.sock;
    include fastcgi_params;
}