External risk intelligence

dulldusk phpfm Unrestricted File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72592

The product is a file manager application that, by default, lacks authentication and allows unrestricted file uploads. As a web-based file management tool intended for remote access, it is designed to be reachable over the network and is frequently exposed as a public-facing endpoint in its default, insecure configuration.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects a web-based file manager application, allowing unauthenticated remote attackers to upload and execute arbitrary code on servers. The default configuration lacks essential security controls, potentially exposing systems to severe compromise.

Allows code execution via uploaded files.
Threatens server integrity with default settings.
Verify if this file manager is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by exploiting an unrestricted file upload feature in the PHP file manager. Since the application has no default authentication and allows any file extension to be uploaded, an attacker can upload a malicious PHP file (webshell) to the server and then access it directly via a web browser to execute arbitrary code.

No authentication or network exposure required.
Upload and browse to a malicious PHP file.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary PHP code on the server when an empty upload extension filter and no authentication are enabled by default. This could affect the integrity and availability of the server and any data it processes.

Server-side code execution.
Uploading malicious PHP webshells.
Compromise of server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in dulldusk/phpfm impacts any environment where it is deployed without proper security configurations. The first step is to identify all instances of this file manager, determine their reachability and business criticality, and then engage the accountable owner to plan remediation, likely involving application owners and infrastructure teams.

Application owners should manage this issue.
Verify file upload configurations and reachability.
Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the dulldusk phpfm software?

dulldusk phpfm is a lightweight, web-based file management application. Developers and administrators typically use it to organize, upload, and manage files on a web server directly through a browser interface.

What does CWE-434 mean for CVE-2026-72592?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this CVE, it means the software fails to limit the types of files users can upload. Because the application does not filter file extensions, an attacker can upload a malicious script—like a PHP webshell—and the server will treat it as legitimate code.

How does an attacker trigger this vulnerability?

An attacker triggers this by simply sending a malicious file to the server through the application's upload function. No existing user account or special permissions are required. Note that this attack does not rely on complex exploits; it succeeds because the default settings allow any file type and require no password to access the upload feature.

Is my instance of phpfm at risk?

If your instance is reachable over the network, Halo Surface Signal identifies it as being at high risk. Because the software is designed for remote file management and lacks default authentication, it is often exposed as a public-facing endpoint, making it an easy target for remote attackers to interact with directly.

How should I respond to CVE-2026-72592?

Start by auditing your environment to locate all deployments of phpfm. Since the default configuration is inherently insecure, prioritize isolating any public-facing instances immediately. Coordinate with your application teams to restrict access or disable the software until you can apply secure configuration changes or migrate to a more robust file management solution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.