Description

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. The authentication check in index.php at line 637 evaluates 'if ($auth_pass == '' || $loggedon==$auth_pass)', and since auth_pass is an empty string in the default configuration, the condition always evaluates to true and grants full access without credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T11:17:32.490Z",
  "pubdate": "2026-08-10T11:17:32.490Z",
  "executiveSummary": "A missing authentication vulnerability exists in dulldusk/phpfm through version 1.8.0, allowing unauthenticated remote attackers to achieve full administrative control over the underlying server filesystem.\nThe flaw stems from an insecure default configuration and a flawed conditional check within the authentication logic, which inadvertently bypasses security controls entirely when passwords are not explicitly configured.\nImpacted systems include any deployment of phpfm up to version 1.8.0 utilizing the default configuration state.\nRisk implications are critical, as successful exploitation grants arbitrary file read, write, upload, and deletion capabilities over the entire server filesystem to any remote unauthenticated entity.\nAttacker capabilities include remote code execution potential, data exfiltration, system modification, and complete administrative compromise of the web application.\nExploitation requirements are minimal, requiring only network access to the target application with no prior authentication, valid credentials, or user interaction necessary.",
  "technicalDetails": "The root cause of the vulnerability resides in index.php at line 637 within the dulldusk/phpfm application through version 1.8.0.\nThe authentication evaluation logic explicitly checks 'if ($auth_pass == '' || $loggedon==$auth_pass)', which determines whether a session is authorized to execute file manager operations.\nIn the default configuration, the variable $auth_pass is initialized as an empty string.\nConsequently, the first operand of the logical OR expression evaluates to true regardless of the state or existence of the $loggedon variable.\nThis design flaw forces the entire conditional statement to evaluate to true, completely bypassing the intended authentication gate and granting full access to unauthenticated requests.\nThe vulnerable component is the core authentication check located in index.php, which guards access to the full file manager functionality.\nAffected versions comprise dulldusk/phpfm through 1.8.0.\nNetwork exposure is remote, as the vulnerable script is directly accessible via standard HTTP/HTTPS requests over the network.\nAuthentication and privilege requirements are entirely absent, allowing unauthenticated remote attackers to interact with the system directly.\nThe attack flow begins when an unauthenticated remote attacker sends an HTTP request to index.php.\nUpon receiving the request, index.php executes the flawed authentication check on line 637.\nBecause $auth_pass equals an empty string in the default configuration, the condition evaluates to true without validating any provided credentials or session tokens.\nThe application subsequently initializes the session and grants the requester full privileges to the file manager interface.\nPost-exploitation impact includes unauthenticated file read operations to harvest sensitive system configuration files or source code, file write and upload operations to deploy web shells for remote code execution, and file deletion operations to cause denial of service or destroy critical data anywhere accessible by the web server process."
}