Description

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-22T15:17:25.197Z",
  "pubdate": "2026-09-22T15:17:25.197Z",
  "executiveSummary": "A critical unrestricted file upload vulnerability exists in JosephChuks php-file-manager-with-code-editor up to version 3.0. The vulnerability stems from improper input validation within the Save Handler component.\nThe flaw allows remote, unauthenticated attackers to manipulate file parameters to write arbitrary data to the server's filesystem. Successful exploitation results in Remote Code Execution (RCE) by enabling the deployment of web shells or malicious scripts.\nGiven that the vulnerability is publicly disclosed and the vendor has remained unresponsive, the risk is elevated. The impact includes full server compromise, data exfiltration, and unauthorized system access. No specific authentication is required to trigger this vulnerability, making it highly accessible to remote threat actors.",
  "technicalDetails": "The vulnerability resides in the codeEditor.php file, specifically within the function handling the file_put_contents operation. This function is designed to save changes made via the code editor interface; however, it fails to perform adequate server-side validation on the 'filename' and 'content' parameters provided during the save request.\nIn the vulnerable implementation, the application accepts user-supplied input for both the target file path and the associated file content without sanitizing directory traversal sequences or restricting file extensions. By manipulating the filename argument, an attacker can bypass intended directory restrictions to overwrite existing system files or create new executable files in arbitrary locations within the web root.\nThe attack flow follows a predictable pattern: first, the attacker interacts with the Save Handler component of the web application. Second, the attacker submits a crafted HTTP request containing a malicious payload in the 'content' field and a target path in the 'filename' field (e.g., a path leading to a .php file). Third, the server-side script executes file_put_contents using these tainted inputs. Because the application lacks a whitelist of allowed file extensions or meaningful path validation, the server persists the malicious payload directly to the disk.\nPost-exploitation, the attacker can navigate to the URL corresponding to the newly created or overwritten file. Upon accessing this file, the web server processes the malicious script, granting the attacker arbitrary code execution with the permissions of the web server user (e.g., www-data). This allows for full administrative control over the application environment, potentially leading to privilege escalation or lateral movement within the network. The lack of interaction with an authentication layer means that any attacker with network access to the target host can weaponize this flaw without prior credentials."
}