What is the CVSS score of CVE-2026-51027?

CVE-2026-51027 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of FileThingie are affected by CVE-2026-51027?

FileThingie 2.5.7 contains a critical information disclosure vulnerability in its ft2.php component that allows remote attackers to retrieve sensitive data.

How to fix or mitigate CVE-2026-51027?

Within 24 hours, inventory all systems running FileThingie 2.5.7 and assess what sensitive data is accessible through the application; given that publicly available exploit code exists, treat all instances as actively threatened. Within 7 days, disable or restrict network access to FileThingie 2.5.7 (particularly the ft2.php component) via firewall rules or reverse proxy authentication, deploy Web Application Firewall (WAF) rules to block exploitation attempts against ft2.php, and isolate affected systems to restricted network segments. Within 30 days, evaluate alternative file-sharing solutions to replace FileThingie 2.5.7, as no vendor-released patch is identified at this time; implement compensating controls and monitor vendor advisories for any future security updates.

FileThingie CVE-2026-51027

EUVD-2026-45991 CRITICAL

Information Exposure (CWE-200)

2026-07-20 mitre

GHSA-ppgq-9wj5-42r6

PHP Information Disclosure N A

9.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Remote low-privilege HTTP access to ft2.php (AV:N/AC:L/PR:L); description is confidentiality-only information disclosure, so I:N/A:N and no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:52 vuln.today

CVE Published

Jul 20, 2026 - 00:00 cve.org

CRITICAL 9.9

DescriptionCVE.org

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

Articles & Coverage 1

News Critical Information Disclosure in FileThingie 2.5.7 (PHP) - CVE-2026-51027 Jul 20, 2026

AnalysisAI

Information disclosure in FileThingie 2.5.7, a single-file PHP web-based file manager, lets a remote attacker retrieve sensitive information through the ft2.php component. The flaw is documented in a third-party vulnerability-research repository, indicating exploitation details are likely public, though it is not listed in CISA KEV. The published CVSS 9.9 rating overstates impact relative to the description, which describes only information disclosure rather than full compromise.

Technical ContextAI

FileThingie is a lightweight, self-contained PHP file-management application (single ft2.php script plus configuration) historically distributed via the leefish/filethingie GitHub project and typically dropped into an existing web root to browse, upload, and manage files. The vulnerability resides in the ft2.php component, which is both the front controller and the handler for file/directory operations. No CWE was assigned (CWE: N/A) and the CPE is a placeholder (cpe:2.3:a:n/a:n/a), so the exact weakness class is not formally classified; based on the 'Information Disclosure' tag and the description, the root cause is most consistent with improper access control or path/parameter handling in ft2.php that exposes file contents or system information to unauthorized requests. Because it is a PHP application executed server-side, exploitation is via crafted HTTP requests to the ft2.php endpoint.

RemediationAI

No vendor-released patch identified at time of analysis - the references point only to the upstream project (https://github.com/leefish/filethingie) and a research repository (https://github.com/SpeWnz/Vulnerability-Research/tree/main/CVE-2026-51027), not to a tagged fixed release. As compensating controls, restrict network access to the ft2.php endpoint by placing FileThingie behind authenticated reverse-proxy access controls or IP allow-listing (trade-off: legitimate remote users must be pre-authorized), enforce and review FileThingie's own login/authentication configuration so anonymous access is disabled (trade-off: none significant if remote convenience is not required), and consider removing FileThingie from internet-facing servers or replacing it with a maintained file manager if no upstream fix appears (trade-off: operational migration effort). Monitor the upstream GitHub project and the referenced research repo for a patched version and fix commit before re-enabling exposed access.