EUVD-2026-55163
GHSA-pp5f-3rgg-523r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default empty-password config allows unauthenticated network access with no interaction (AV:N/AC:L/PR:N/UI:N), yielding full filesystem read/write/delete, so C:H/I:H/A:H.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. The authentication check in index.php at line 637 evaluates 'if ($auth_pass '' || $loggedon$auth_pass)', and since auth_pass is an empty string in the default configuration, the condition always evaluates to true and grants full access without credentials.
Articles & Coverage 2
AnalysisAI
Missing authentication in dulldusk/phpFM through version 1.8.0 exposes the complete file manager to unauthenticated remote attackers because the default configuration ships with an empty auth_pass value. The flawed check in index.php (line 637, 'if ($auth_pass == '' || $loggedon==$auth_pass)') short-circuits to true whenever the password is unset, granting anyone full read, write, delete, and upload access to the server filesystem. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that phpFM be deployed with the default configuration where $auth_pass is an empty string; under that condition the line-637 check 'if ($auth_pass == '' || $loggedon==$auth_pass)' always evaluates true and grants full access with no credentials, no user interaction, and no prior authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes the worst practical case: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact - consistent with unauthenticated full filesystem control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an internet-exposed phpFM index.php running with the default empty auth_pass and simply browses to it, immediately receiving the authenticated file-manager interface without supplying credentials. From there they read sensitive files (config, credentials), upload a PHP webshell, and delete or tamper with data - pivoting to full server compromise. … |
| Remediation | No vendor-released patch identified at time of analysis, and no fixed version number is present in the input data, so a version-based upgrade cannot yet be cited. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all phpFM installations across infrastructure; immediately disable or air-gap any internet-facing instances using firewall rules or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today