CVE-2026-95499: PHP File Manager RCE Vulnerability

CVE-2026-95499 Overview

CVE-2026-95499 is an unrestricted file upload vulnerability affecting JosephChuks php-file-manager-with-code-editor up to version 3.0. The flaw resides in the move_uploaded_file function within filemanager.php, where manipulation of the files argument allows attackers to upload arbitrary files. The issue is remotely exploitable and requires no authentication or user interaction. The vendor was contacted prior to public disclosure but did not respond. The weakness is categorized under [CWE-284: Improper Access Control].

Critical Impact
Remote unauthenticated attackers can upload arbitrary files to the target host, which can lead to web shell placement and follow-on server compromise.

Affected Products

JosephChuks php-file-manager-with-code-editor 1.0
JosephChuks php-file-manager-with-code-editor 2.0
JosephChuks php-file-manager-with-code-editor 3.0

Discovery Timeline

2026-09-22 - CVE-2026-95499 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95499

Vulnerability Analysis

The vulnerability exists in the file upload handler of filemanager.php. The application invokes move_uploaded_file on attacker-supplied input passed through the files argument without enforcing sufficient restrictions on file type, extension, or destination path. Because the affected component is a PHP-based file manager, uploading a .php file into a web-accessible directory allows the attacker to request that file and trigger server-side code execution. Exploitation is possible over the network without authentication or user interaction, which lowers the barrier for opportunistic attacks against internet-exposed installations.

Root Cause

The root cause is improper access control ([CWE-284]) around the file upload workflow. The move_uploaded_file call trusts the files parameter and does not validate MIME type, extension allow-lists, or authenticated caller identity before persisting the uploaded content. Missing authorization on the endpoint compounds the missing input validation.

Attack Vector

An attacker sends a crafted HTTP POST request to the vulnerable filemanager.php endpoint with a multipart file payload referenced by the files parameter. Because no authentication is required, any host able to reach the application over the network can submit the request. Once written to a web-accessible directory, the uploaded PHP file can be executed by requesting its URL.

No verified proof-of-concept code has been published for this vulnerability. See the VulDB entry for CVE-2026-95499 for additional technical context.

Detection Methods for CVE-2026-95499

Indicators of Compromise

Unexpected .php, .phtml, or .phar files in directories writable by the web server, particularly under paths served by the file manager.
HTTP POST requests to filemanager.php containing multipart form data with the files parameter from untrusted sources.
New outbound network connections initiated by the PHP worker process shortly after upload activity.

Detection Strategies

Inspect web server access logs for POST requests to filemanager.php followed by GET requests to newly created files in upload directories.
Deploy Web Application Firewall (WAF) rules that block multipart uploads containing executable extensions to the affected endpoint.
Perform file integrity monitoring on web root directories to alert on the creation of new server-side script files.

Monitoring Recommendations

Alert on process spawns from the PHP interpreter (php-fpm, httpd, apache2) that invoke shells or system utilities.
Baseline legitimate administrative traffic to filemanager.php and flag requests from unexpected source IPs or user agents.
Correlate file creation events in web-accessible directories with subsequent HTTP requests to the same paths.

How to Mitigate CVE-2026-95499

Immediate Actions Required

Remove php-file-manager-with-code-editor from internet-facing hosts until a patched release is available, since the vendor has not responded to disclosure.
Restrict access to filemanager.php using network ACLs, reverse-proxy authentication, or IP allow-lists.
Audit the web root and upload directories for unauthorized script files and remove any that are identified.

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to the disclosure attempt referenced in the VulDB advisory. Organizations should treat the software as unmaintained and plan migration to an alternative file manager.

Workarounds

Configure the web server to deny execution of PHP files inside upload directories using php_flag engine off or equivalent Nginx location rules.
Enforce authentication in front of the file manager using an HTTP reverse proxy such as Nginx or Apache with basic or SSO authentication.
Apply WAF rules that reject uploads with executable extensions (.php, .phtml, .phar, .php5, .pht) to the vulnerable endpoint.

bash

# Example Apache configuration to block script execution in an uploads directory
<Directory "/var/www/html/uploads">
    php_flag engine off
    AddType text/plain .php .phtml .phar .php5 .pht
    <FilesMatch "\.(php|phtml|phar|php5|pht)$">
        Require all denied
    </FilesMatch>
</Directory>