External risk intelligence

Dulldusk PHP File Manager Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72593

The product is a file manager application designed to be hosted on web servers. The default configuration allows unauthenticated remote access to core functionality, and such tools are typically deployed as internet-facing interfaces for file manipulation, making them highly susceptible to public-internet exposure by design.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a file management tool that could allow unauthorized access to server files if not properly secured. The default configuration enables access to all functions, including reading, writing, deleting, and uploading files, without requiring any authentication.

Unauthenticated attackers can control server files remotely.
Default settings permit unauthorized access to file management.
Verify if this tool is deployed and configured securely.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by simply sending a request to the file manager's web interface. Because the product's default configuration allows unauthenticated users to bypass the authentication check, the attacker gains immediate access to all file management functions. This could allow them to read, write, delete, or upload files anywhere on the server.

Attacker can reach the file manager remotely.
Vulnerable component allows access without credentials.
Full file system control is possible.

Live Threat

Current exploitation, exposure, and threat context

A missing authentication vulnerability in dulldusk/phpfm could allow an unauthenticated remote attacker to access the full file manager functionality, including reading, writing, deleting, and uploading files anywhere on the server filesystem. This is possible because the default configuration results in the authentication check always evaluating to true, granting full access without credentials.

Server filesystem and data.
Unauthenticated remote network access.
Complete file control and compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in dulldusk/phpfm allows unauthenticated remote attackers to gain full control over file operations on the server. Initial triage should focus on identifying all instances of this software, confirming their exposure and business criticality, and then locating the accountable owner for remediation planning.

Application owners should own the issue.
Verify external access and asset criticality first.
Plan remediation around maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is dulldusk/phpfm?

Dulldusk/phpfm is a web-based file management application designed to run on a server. It provides a graphical interface that allows users to interact with the server's filesystem directly through a browser, enabling common tasks like uploading, downloading, editing, and deleting files remotely.

What does CWE-306 mean for CVE-2026-72593?

CWE-306 refers to a Missing Authentication for Critical Function vulnerability. In the context of this CVE, it means the software fails to verify the identity of a user before granting access to sensitive administrative controls, allowing anyone to perform file operations without providing credentials.

How is this vulnerability triggered?

The vulnerability is triggered simply by accessing the file manager's main entry point over the network. Because the underlying code checks if an empty password is valid—and accepts it by default—no specific malicious payload or complex maneuver is required to bypass security; the application effectively grants access to the first person who visits it.

Is my system at risk?

According to Halo Surface Signal, this software is often deployed as an internet-facing tool, making it highly susceptible to discovery and unauthorized use. If you have instances of this file manager accessible from the public internet, they are at significant risk because the default configuration provides no barrier to entry for remote attackers.

What should I do if I use this tool?

First, conduct an inventory to locate all active instances of this software within your environment. Prioritize restricting network access to these interfaces immediately—preferably by moving them behind a private network or firewall—and consult the application documentation to implement strong, non-default authentication before allowing further use.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.