What is the CVSS score of CVE-2026-51027?

CVE-2026-51027 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of FileThingie are affected by CVE-2026-51027?

FileThingie 2.5.7 contains a critical information disclosure vulnerability in its ft2.php component that allows remote attackers to retrieve sensitive data.

How to fix or mitigate CVE-2026-51027?

Within 24 hours, inventory all systems running FileThingie 2.5.7 and assess what sensitive data is accessible through the application; given that publicly available exploit code exists, treat all instances as actively threatened. Within 7 days, disable or restrict network access to FileThingie 2.5.7 (particularly the ft2.php component) via firewall rules or reverse proxy authentication, deploy Web Application Firewall (WAF) rules to block exploitation attempts against ft2.php, and isolate affected systems to restricted network segments. Within 30 days, evaluate alternative file-sharing solutions to replace FileThingie 2.5.7, as no vendor-released patch is identified at this time; implement compensating controls and monitor vendor advisories for any future security updates.

FileThingie CVE-2026-51027

EUVD-2026-45991 CRITICAL

Information Exposure (CWE-200)

2026-07-20 mitre

GHSA-ppgq-9wj5-42r6

PHP Information Disclosure N A

9.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Remote low-privilege HTTP access to ft2.php (AV:N/AC:L/PR:L); description is confidentiality-only information disclosure, so I:N/A:N and no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:52 vuln.today

CVE Published

Jul 20, 2026 - 00:00 cve.org

CRITICAL 9.9

DescriptionCVE.org

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

Articles & Coverage 1

News Critical Information Disclosure in FileThingie 2.5.7 (PHP) - CVE-2026-51027 Jul 20, 2026

AnalysisAI

Information disclosure in FileThingie 2.5.7, a single-file PHP web-based file manager, lets a remote attacker retrieve sensitive information through the ft2.php component. The flaw is documented in a third-party vulnerability-research repository, indicating exploitation details are likely public, though it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach FileThingie ft2.php endpoint

Delivery

Authenticate with low-privilege account

Exploit

Send crafted disclosure request

Execution

Read unauthorized file/system data

Impact

Exfiltrate sensitive information

Access

Reach FileThingie ft2.php endpoint

Delivery

Authenticate with low-privilege account

Exploit

Send crafted disclosure request

Execution

Read unauthorized file/system data

Impact

Exfiltrate sensitive information

Vulnerability AssessmentAI

Exploitation	Exploitation targets the ft2.php component of FileThingie 2.5.7 and is performed remotely over HTTP (AV:N/AC:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals conflict and warrant caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with network reach to the FileThingie install sends a crafted HTTP request to the ft2.php component and receives file contents or configuration/system information they should not be able to read. Because a third-party research repository documents CVE-2026-51027, working exploitation steps or a proof-of-concept may already be publicly available, lowering the skill required.
Remediation	No vendor-released patch identified at time of analysis - the references point only to the upstream project (https://github.com/leefish/filethingie) and a research repository (https://github.com/SpeWnz/Vulnerability-Research/tree/main/CVE-2026-51027), not to a tagged fixed release. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running FileThingie 2.5.7 and assess what sensitive data is accessible through the application; given that publicly available exploit code exists, treat all instances as actively threatened. …

Threat intelligence, references, and detailed analysis are available after sign-in.