phpIPAM CVE-2026-75105

Exploitation requires two concrete preconditions: (1) at least one temporary share of type 'subnets' must have been created by an administrator and must not yet be expired - the phpIPAM temporary share feature is not enabled by default but is available to any admin; (2) the attacker must possess any valid, non-expired temporary share URL for the phpIPAM instance, regardless of which subnet it covers. Exploitation is limited to deployments where the temporary share feature has been actively used. The attacker does not need a phpIPAM account, does not need to know the correct subnetId in advance (they enumerate it), and does not need the share URL to cover the target subnet. Scope is bounded only by the total number of IP address records stored in the database, not by the subnet the share was issued for.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) appropriately reflects network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact. The effective threat model requires that at least one temporary share of type 'subnets' has been created and that a valid, non-expired share URL is in the attacker's possession - this is not a zero-configuration attack surface. However, temporary share URLs are by design intended for distribution to external parties, so possession of one is a modest and realistic precondition. The impact ceiling is severe: a single enumeration sweep across sequential integer subnetIds can reconstruct the organization's entire IP inventory including internal hostnames, MAC addresses, and notes fields that frequently store credentials and configuration snippets. No EPSS data was provided and no KEV listing exists, so widespread active exploitation is not confirmed. Despite the absence of a known public POC, the attack is trivially automatable (simple HTTP GET loop with incrementing subnetId), meaning time-to-exploit once an attacker has any valid share URL is extremely low. Real-world priority should be high for any phpIPAM deployment that uses the temporary share feature.

An attacker receives a legitimate temporary share URL for a single /24 subnet - perhaps forwarded by an employee or extracted from an email archive - and observes the subnetId integer in the URL. The attacker writes a simple loop that increments subnetId from 1 to several thousand, issuing an authenticated-looking GET request to the temp_share endpoint for each value, and harvests every IP address record returned including hostnames, MAC addresses, and notes fields across all subnets in the organization. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the CVE description alone.