phpFM EUVD-2026-55163

Exploitation requires that phpFM be deployed with the default configuration where $auth_pass is an empty string; under that condition the line-637 check 'if ($auth_pass '' || $loggedon$auth_pass)' always evaluates true and grants full access with no credentials, no user interaction, and no prior authentication. The concrete prerequisite is a network-reachable index.php on an instance whose operator has not set a non-empty $auth_pass. The primary limiting factor is exactly that configuration state: any deployment where an administrator assigned a non-empty $auth_pass is not exploitable via this bypass. Beyond that, no platform, version-specific, or interaction constraints apply within the affected range (through 1.8.0).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes the worst practical case: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact - consistent with unauthenticated full filesystem control. This is a genuine high priority where the product is internet-exposed with default settings, since exploitation is a matter of simply requesting index.php. Tempering that: exploitation depends on the default empty-password deployment; an operator who set a non-empty $auth_pass is not affected by this specific bypass, so the real-world blast radius is a function of how many deployments run unconfigured. No EPSS score, no KEV listing, and no SSVC decision data were provided, so automatability and observed-exploitation signals cannot be quantified from the input - treat the score as a capability ceiling rather than evidence of active mass exploitation. The absence of a KEV entry means there is no confirmation of in-the-wild use; prioritize based on exposure and default-config prevalence rather than assumed active exploitation.

An attacker discovers an internet-exposed phpFM index.php running with the default empty auth_pass and simply browses to it, immediately receiving the authenticated file-manager interface without supplying credentials. From there they read sensitive files (config, credentials), upload a PHP webshell, and delete or tamper with data - pivoting to full server compromise. No public proof-of-concept is cited, but the vulnerable branch is visible in the referenced source and exploitation requires only an HTTP request.