Description

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-22T14:17:20.730Z",
  "pubdate": "2026-09-22T14:17:20.730Z",
  "executiveSummary": "The php-file-manager-with-code-editor, versions up to 3.0, is susceptible to an unrestricted file upload vulnerability.\nThis flaw resides within the move_uploaded_file function located in filemanager.php, allowing remote attackers to bypass security controls regarding file uploads.\nThe vulnerability allows an unauthenticated attacker to upload arbitrary files to the web server's filesystem.\nSuccessful exploitation grants the attacker the ability to execute remote code, perform arbitrary file writes, or overwrite existing system files, potentially leading to a complete compromise of the server environment.\nGiven the nature of the application as a file manager, this vulnerability poses a high-risk security threat, as it enables the injection of malicious scripts, such as web shells, directly into the document root or other sensitive directories.\nThere are no authentication requirements mentioned for this vector, and the attack can be executed remotely over a network.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and insufficient sanitization of user-supplied data within the move_uploaded_file logic in filemanager.php. The application fails to adequately verify the contents, type, or destination path of files being processed via the 'files' argument during an upload operation.\nThe exploitation process involves an attacker interacting with the filemanager.php endpoint. By manipulating the 'files' parameter, an attacker can influence the file system operations performed by the server. When the application calls move_uploaded_file, it relies on unsanitized input to define the destination path or the nature of the file being moved.\nAn attacker can craft a multipart/form-data request containing a malicious payload—such as a PHP web shell (e.g., .php or .phtml extensions)—and direct the application to write this file into an accessible directory on the web server. Because the application lacks a whitelist-based validation mechanism to restrict file extensions or MIME types, the server treats the uploaded file as a legitimate asset.\nThe attack flow proceeds as follows: First, the attacker identifies the filemanager.php endpoint as the processing target. Second, the attacker initiates an HTTP POST request, injecting the malicious binary or script into the 'files' argument. Third, the server-side script fails to perform validation on the file metadata or path, leading the move_uploaded_file function to store the malicious file in a target directory determined by the manipulated parameter. Finally, the attacker navigates to the location of the uploaded file via a standard web browser request, causing the server to execute the injected code within the context of the web server process.\nThe post-exploitation impact is severe. Once a malicious script is executed, the attacker gains remote command execution capabilities. This permits the attacker to interact with the underlying operating system, escalate privileges if the web server process is misconfigured, exfiltrate sensitive data stored on the host, pivot into internal network segments, or deploy further persistent malware.\nThe vulnerability affects all versions of php-file-manager-with-code-editor up to and including 3.0. The lack of robust server-side security controls for file handling makes the implementation inherently insecure against remote exploitation."
}