Description

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ($upload_ext_filter = array()) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T11:17:32.370Z",
  "pubdate": "2026-08-10T11:17:32.370Z",
  "executiveSummary": "An unrestricted file upload vulnerability exists in dulldusk/phpfm through version 1.8.0, enabling unauthenticated remote attackers to execute arbitrary PHP code on the underlying server. The application ships with default configurations that disable authentication entirely, leaving the auth_pass parameter as an empty string, and fail to enforce any restrictions via the upload extension filter, configured as an empty array ($upload_ext_filter = array()). This combination allows remote threat actors to upload executable payloads directly to the web root without requiring valid credentials or specialized privileges. The security implications are critical, as successful exploitation grants full remote code execution capabilities, compromising the integrity, confidentiality, and availability of the host system. The attack requires network access to the vulnerable phpfm instance, but no prior authentication or interaction is needed. Remediation requires enforcing strict file extension validation and enabling robust authentication mechanisms by default.",
  "technicalDetails": "The vulnerability resides in the file upload component of dulldusk/phpfm through version 1.8.0. The root cause of the flaw is the absence of input validation and file extension filtering combined with disabled default authentication. Specifically, the application initializes the upload extension filter as an empty array ($upload_ext_filter = array()), which fails to restrict the types of files that can be uploaded to the server. Furthermore, the administrative authentication mechanism is uninitialized by default, evidenced by an empty string assigned to the auth_pass parameter.\nThe attack flow proceeds as follows. First, an unauthenticated remote attacker discovers the exposed phpfm instance over the network. Because authentication is not enabled by default, the attacker can access the file management interface without providing credentials or establishing a valid session. Second, the attacker crafts a multipart HTTP POST request containing a malicious payload, typically a PHP webshell disguised as or directly written to a .php file. Third, the attacker leverages the unrestricted file upload functionality to transmit the payload to the server. Due to the lack of enforcement in the $upload_ext_filter mechanism, the application stores the arbitrary PHP file within the web-accessible directory structure.\nFinally, post-exploitation impact is realized when the attacker navigates directly to the uploaded file path via an HTTP GET request. The web server interprets and executes the embedded PHP code within the context of the web server process. This grants the attacker arbitrary remote code execution capabilities, allowing them to manipulate the filesystem, execute system commands, exfiltrate sensitive data, or pivot further into the internal network."
}