What is the CVSS score of CVE-2026-42569?

CVE-2026-42569 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of phpVMS are affected by CVE-2026-42569?

CVE-2026-42569 affects phpVMS versions 7.x through 7.0.5 and enables unauthenticated remote attackers to delete entire databases through an unprotected legacy importer endpoint, potentially causing…. A patch is available.

Is there a public PoC exploit available for CVE-2026-42569?

Yes, a public proof-of-concept exploit is available for CVE-2026-42569. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-42569?

Within 24 hours: Identify all phpVMS 7.x installations and confirm current versions via admin panel or GitHub repository check; isolate any running versions 7.0.5 or earlier from public internet access if immediate patching is not feasible. Within 7 days: upgrade all phpVMS installations to version 7.0.6 or later per vendor advisory GHSA-fv26-4939-62fh; verify upgrade completion and test importer endpoint access. Within 30 days: conduct database integrity audit to confirm no unauthorized modifications occurred; review access logs for /importer endpoint requests during vulnerable window; implement Web Application Firewall (WAF) rules blocking access to /importer endpoint as permanent compensating control.

phpVMS CVE-2026-42569

CRITICAL

Improper Access Control (CWE-284)

2026-05-04 https://github.com/phpvms/phpvms

GHSA-fv26-4939-62fh

Authentication Bypass

9.4

CVSS 3.1 · Vendor: https://github.com/phpvms/phpvms

Severity by source

Vendor (https://github.com/phpvms/phpvms) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Primary rating from Vendor (https://github.com/phpvms/phpvms) · only source for this CVE.

CVSS VectorVendor: https://github.com/phpvms/phpvms

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 04, 2026 - 21:46 vuln.today

Analysis Generated

May 04, 2026 - 21:46 vuln.today

DescriptionCVE.org

Security Advisory: Unauthenticated Access to Legacy Import Feature

Severity: Critical Affected versions: phpVMS 7.x (up to 7.0.5) Fixed in: v7.0.6 Component: Legacy importer

Summary

A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.

Impact

A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:

Data loss
Service disruption

No authentication was required.

Remediation

Update immediately to the latest patched version
If unable to update:
The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)

Affected Versions

Affected: phpVMS 7.x ≤ 7.0.5
Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)

Articles & Coverage 1

POC CVE-2026-42569: Unauthenticated Database Wipe in phpVMS ≤ 7.0.5 May 11, 2026

AnalysisAI

Unauthenticated remote attackers can trigger complete database wipes and data deletion in phpVMS 7.x through 7.0.5 by accessing an exposed legacy importer endpoint at /importer. The vulnerability stems from deprecated import functionality that remained publicly accessible without authentication checks, allowing remote data modification or destruction. Vendor-released patch (v7.0.6) confirmed via GitHub advisory GHSA-fv26-4939-62fh. No CISA KEV listing or public exploit code identified at time of analysis, but trivial exploitation (CVSS AV:N/AC:L/PR:N/UI:N) makes active targeting likely.

Technical ContextAI

phpVMS is a PHP-based virtual airline management system (composer package nabeel/phpvms). The vulnerability exists in the RouteServiceProvider which registered unauthenticated routes for a legacy importer controller at the /importer prefix. The importer endpoints (/importer/, /importer/config, /importer/dbtest, /importer/run, /importer/complete) were exposed with only the generic 'web' middleware, missing authentication/authorization middleware required for administrative functions. The /importer/run endpoint could execute database import operations that include data truncation/deletion. This represents CWE-284 (Improper Access Control) where critical administrative functionality lacked authentication boundaries. The fix removes the mapImporterRoutes() method entirely, eliminating public exposure of these dangerous endpoints.

RemediationAI

Primary fix: Upgrade immediately to phpVMS version 7.0.6 or later (vendor recommends 7.0.7 per advisory). Download patched release from https://github.com/phpvms/phpvms/releases/tag/7.0.7. The fix (commit f59ba8e0) completely removes the mapImporterRoutes() method from app/Providers/RouteServiceProvider.php, eliminating public access to importer endpoints. Emergency workaround if immediate upgrade impossible: Comment out the single line '$this->mapImporterRoutes();' in RouteServiceProvider.php per vendor instructions (one-line code change). This prevents route registration without requiring full upgrade. Trade-off: Manual code modification requires careful version control and will be overwritten by future updates if not properly tracked. Web application firewall rule to block /importer/* paths provides additional defense-in-depth but should not replace patching as attackers may find alternate routes. Verify fix by attempting to access /importer endpoint - should return 404 after remediation. Advisory: https://github.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fh.