php-file-manager-with-code-editor CVE-2026-95499

Exploitation requires reaching the file-upload handler in filemanager.php and controlling the 'files' argument consumed by move_uploaded_file, then supplying a filename/content that evades the app's upload restrictions. Realistic impact (code execution) additionally requires that the uploaded file land in a web-accessible directory where the server will execute PHP. Limiting factors the input leaves unconfirmed: whether the endpoint is truly reachable without authentication (the vector claims PR:N but a file-manager-with-code-editor normally sits behind a login), and whether write location/execution is actually achievable - VulDB's Low impact triad suggests possible constraints. No user interaction is required per the vector.

The only quantitative signals come from a single source (VulDB): a CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) and CWE-434 (Unrestricted Upload). There is no EPSS score, no CISA KEV listing, and no SSVC decision content in the input, and no explicit POC flag - so the classic prioritization signals are absent, giving 'no public exploit identified at time of analysis.' The most important tension is internal: CWE-434 unrestricted file upload against a PHP web application typically yields web-shell code execution (a full C:H/I:H/A:H / RCE outcome), yet VulDB scored the impact triad as only Low (VC:L/VI:L/VA:L). That downgrade is questionable - either VulDB judged the upload to be constrained (e.g. to a non-executable directory or with partial filtering) or under-rated a genuine RCE primitive; the terse description does not let us confirm which. Also note the vector claims PR:N (unauthenticated), but the affected component is a file manager with code editor, a class of app that is almost always behind a login; the description never states the endpoint is reachable pre-authentication, so PR:N should be treated as unverified. Net: single-source, unconfirmed, no exploitation evidence, and affecting an obscure product - a low real-world priority despite a medium CVSS, but worth patching promptly for anyone actually running this project because unrestricted upload can escalate to RCE.

A remote attacker reaches the filemanager.php upload endpoint and manipulates the 'files' argument passed to move_uploaded_file to write an attacker-controlled file (e.g. a .php web shell) outside the intended constraints. If the upload lands in a web-servable, script-executable path, the attacker then requests it to run arbitrary PHP. No public exploit code is identified in the provided data, and authentication reachability is not confirmed.