PHP File Manager EUVD-2026-55214

Exploitation requires that the phpfm instance be reachable over the network and that the upload feature be accessible - which it is by default because auth_pass ships as an empty string (no authentication) and $upload_ext_filter ships as an empty array (no extension restriction), and the upload directory sits under a PHP-executing document root. No special conditions beyond network access - unauthenticated exploitation succeeds against default configurations of dulldusk phpfm through 1.8.0. Limiting factors that reduce real-world exposure: an operator who has set a non-empty auth_pass forces authentication before upload, an operator who has populated $upload_ext_filter with a safe allowlist blocks the PHP webshell, and a server configured to not execute PHP in the upload path prevents the final code-execution step even if a file is uploaded.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) aligns cleanly with the description: network-reachable, low-complexity, no privileges, no user interaction, full CIA loss - this is a genuine unauthenticated RCE rather than an inflated high-CVSS-low-real-risk case. The two insecure defaults (empty extension filter and empty auth_pass) mean a default deployment is exploitable out of the box, which raises real-world risk above what a config-dependent flaw would carry. Tempering that: no EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active exploitation yet - the danger is potential and opportunistic (mass webshell scanning) rather than confirmed in-the-wild activity, and any operator exposing phpfm to the internet should treat this as urgent and take it offline or lock it down immediately. The main uncertainty is deployment scope: because phpfm is a niche tool, exploitation is more likely to be broad opportunistic scanning of the few exposed instances than a targeted campaign.

An attacker scanning for exposed phpfm instances reaches the default, passwordless interface, uses the file-upload feature to upload shell.php containing a PHP webshell, then browses to the uploaded path to execute it and gain command execution as the web server user. Because AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no credentials or victim interaction; no public POC was provided, but the technique is standard webshell delivery.