EUVD-2026-40114
GHSA-wghr-7f2j-9x3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network read with no user interaction (AV:N/AC:L/PR:N/UI:N) leaking secrets gives C:H; no data modification or service disruption so I:N/A:N and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.
AnalysisAI
Unauthenticated information disclosure in phpUploader before 2.0.2 lets remote attackers harvest the entire uploaded-files database table simply by loading any page of the application. The index model runs an unbounded SELECT and serializes the full result set into an inline JSON script block, leaking uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints. No public exploit identified at time of analysis, but the data is exposed in plain HTML source on every page, making extraction trivial; CVSS 4.0 base is 8.7 (High).
Technical ContextAI
phpUploader is a small PHP-based file-upload web application (vendor 'shimosyan', CPE cpe:2.3:a:shimosyan:phpuploader). The flaw is a CWE-359 (Exposure of Private/Personal Information to an Unauthorized Actor) issue rooted in the application's index model, which queries the uploaded-files table without any row filtering, pagination, or access control and then echoes the JSON-encoded rows directly into an inline <script> block rendered to every visitor. Because the data is embedded server-side into the page markup rather than fetched through an authenticated API, sensitive columns - source IP addresses, Argon2ID password/key hashes, server-side internal filenames, and SHA-256 content fingerprints - are present in the raw HTML returned to any anonymous client.
RemediationAI
Vendor-released patch: upgrade to phpUploader v2.0.2 or later (https://github.com/shimosyan/phpUploader/releases/tag/v2.0.2), which is the definitive fix per PR #294 and commit 45dc4f1. If you cannot upgrade immediately, restrict access to the application at the network layer - place it behind authentication, a VPN, or an IP allowlist so anonymous users cannot reach any page (trade-off: blocks legitimate anonymous uploads, which may be the app's core purpose). As an interim hardening measure, treat all exposed secrets as compromised: rotate any Argon2ID-hashed keys/credentials and assume uploader IPs, internal filenames, and SHA-256 fingerprints have leaked. Reviewing the patch commit to manually remove the unbounded SELECT and inline JSON dump from the index model is an option for forked/customized deployments, but the supported path is the v2.0.2 upgrade.
More in Phpuploader
View allSQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the i
Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today