CVE-2026-95500: PHP File Manager Code Editor RCE Vulnerability

CVE-2026-95500 Overview

CVE-2026-95500 is an unrestricted file upload vulnerability in JosephChuks php-file-manager-with-code-editor through version 3.0. The flaw resides in the file_put_contents call within codeEditor.php, part of the Save Handler component. Attackers can manipulate the filename and content parameters to write arbitrary files to the server without authentication. The issue is classified under [CWE-284] Improper Access Control and is exploitable remotely over the network. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact

Remote, unauthenticated attackers can write arbitrary PHP files to the web root, enabling webshell deployment and full application compromise.

Affected Products

• JosephChuks php-file-manager-with-code-editor 1.0
• JosephChuks php-file-manager-with-code-editor 2.0
• JosephChuks php-file-manager-with-code-editor 3.0

Discovery Timeline

• 2026-09-22 - CVE-2026-95500 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95500

Vulnerability Analysis

The vulnerability affects the Save Handler component in codeEditor.php. The application accepts attacker-controlled filename and content parameters and passes them directly to PHP's file_put_contents function. No authentication, extension filtering, or path validation is enforced before the write operation. As a result, remote actors can create or overwrite files anywhere the web server process can write. Uploading a .php file into a web-accessible directory yields immediate remote code execution through the resulting webshell. The current EPSS probability sits at 0.472% (percentile 38.132), reflecting a publicly disclosed but not yet widely weaponized issue.

Root Cause

The root cause is improper access control [CWE-284] combined with missing input validation on file write parameters. The Save Handler treats the code editor endpoint as a trusted operation and never verifies user identity, session state, target path, or file extension before persisting data to disk.

Attack Vector

An attacker sends a crafted HTTP request to codeEditor.php supplying a chosen filename (for example shell.php) and arbitrary PHP payload as content. The server writes the file to the specified location. The attacker then requests the newly created file through the web server to execute the payload. No credentials, user interaction, or prior foothold are required.

No verified proof-of-concept code is published in the reference material. See the VulDB entry for CVE-2026-95500 and VulDB vulnerability #408348 for technical details.

Detection Methods for CVE-2026-95500

Indicators of Compromise

• Unexpected .php, .phtml, or .phar files appearing in directories served by the web application, particularly with recent modification timestamps.
• HTTP POST requests to codeEditor.php containing filename parameters with executable extensions or path traversal sequences.
• Web server processes spawning shell interpreters (/bin/sh, bash, cmd.exe) shortly after write activity to the application directory.

Detection Strategies

• Monitor web access logs for POST requests to codeEditor.php and correlate with subsequent GET requests to newly created files.
• Deploy file integrity monitoring on the application webroot to flag any new or modified PHP files outside of controlled deployment windows.
• Inspect request bodies for filename parameters that include directory traversal (../) or server-executable extensions.

Monitoring Recommendations

• Alert on child processes spawned by the PHP interpreter or web server user that deviate from baseline application behavior.
• Log and review all filesystem write operations performed by the web server account.
• Enable outbound network traffic monitoring from the web server to detect reverse shells or command-and-control callbacks.

How to Mitigate CVE-2026-95500

Immediate Actions Required

• Remove or restrict network access to codeEditor.php until a patched version is available.
• Audit the web root for unauthorized PHP files and remove any webshells discovered.
• Enforce authentication and authorization checks at the reverse proxy or web server layer for the affected endpoint.

Patch Information

No vendor patch is available. The vendor did not respond to disclosure attempts according to the VulDB advisory. Organizations running php-file-manager-with-code-editor should consider replacing the component with a maintained alternative.

Workarounds

• Block requests to codeEditor.php at the web application firewall or reverse proxy.
• Configure the web server to deny execution of PHP files in any directory where user-supplied content may be written.
• Run the PHP process under a least-privilege account that cannot write to web-accessible directories.
• Implement a file extension allowlist and reject writes to any executable file type at the application boundary.

# Example nginx rule to block access to the vulnerable endpoint
location = /codeEditor.php {
    deny all;
    return 403;
}

# Prevent PHP execution in an uploads directory
location ^~ /uploads/ {
    location ~ \.php$ { deny all; }
}