php-file-manager-with-code-editor EUVD-2026-84426

Requires the attacker to reach the Save Handler in codeEditor.php and control both the filename and file content passed to file_put_contents, with the target directory web-servable so the written .php file can be executed. Vendor rates it as remote unauthenticated (PR:N/UI:N) against php-file-manager-with-code-editor up to 3.0, but file-manager/code-editor applications commonly place such save functions behind an application login - if so, a valid session or credentials are the real limiting factor. Limiting factors: obscure/rare product with negligible deployment; no fixed version available (vendor unresponsive, rolling GitHub release); the upload directory must permit PHP execution.

The vendor's CVSS 4.0 score of 5.5 (AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L) materially understates the technical impact. CWE-434 unrestricted upload here reaches file_put_contents in a Save Handler with attacker-controlled filename AND content - writing an attacker-chosen .php file into a web-served directory yields a webshell and full PHP remote code execution, which is a High confidentiality/integrity/availability outcome, not the Low triad the vendor assigned. The exploit chain conditions (AV:N/AC:L/UI:N) are correctly rated as easy and remote. Exploitation status: publicly available exploit code exists (VulDB reports the exploit was disclosed to the public); this is NOT active exploitation - there is no CISA KEV listing and no EPSS score provided, so exploitation is proven feasible but not confirmed in the wild. The vendor's PR:N is questionable: a file-manager/code-editor Save Handler is typically gated behind an application login, which would raise privileges to PR:L; the description does not confirm whether the Save Handler is reachable pre-authentication. Net: high technical severity (effective RCE) but low real-world urgency given the obscure, tiny-footprint product and absence of KEV/EPSS/active-exploitation signals.

A remote attacker reaches the codeEditor.php Save Handler and submits a request specifying a filename ending in .php with a PHP payload as the content; file_put_contents writes the webshell into a web-accessible path. The attacker then browses to the uploaded file to execute arbitrary PHP as the web-server user. Public exploit code exists per VulDB, lowering the skill barrier.