Unrestricted File Upload Vulnerability in php-file-manager-with-code-editor

CVE-2026-95499 identifies a critical security flaw in the 'php-file-manager-with-code-editor' application, specifically affecting versions up to 3.0. The vulnerability stems from insecure handling of user-supplied data in the 'files' argument passed to the 'move_uploaded_file' function within 'filemanager.php'. This flaw permits remote, unauthenticated attackers to bypass intended restrictions and upload arbitrary files - potentially including malicious PHP scripts - directly to the web server's filesystem. Given the application's nature as a file manager and code editor, successful exploitation leads to remote code execution (RCE) as the web service user. The vendor was notified of the disclosure but remained unresponsive, leaving the vulnerability unpatched in the latest version. Organizations hosting this software are at significant risk of complete server compromise if exposed to the internet.

Impact

Successful exploitation allows for the execution of arbitrary code on the underlying host, facilitating data exfiltration, lateral movement, or complete system takeover. As the affected software is intended for managing files and editing code, attackers can easily maintain persistence or leverage existing server functionality to extend their access. There are no known patches, making decommissioning or strict network isolation the primary defensive measures.

Recommendation

• Immediately isolate the host running php-file-manager-with-code-editor from the internet.
• If the service is required, implement stringent web application firewall (WAF) rules to inspect and block POST requests to 'filemanager.php' that contain suspicious file extensions (e.g., .php, .phtml, .php7) within the 'files' parameter.
• Audit the server filesystem for unexpected files in directories managed by the application, focusing on web-accessible paths.
• Review web server access logs for anomalous POST requests directed at 'filemanager.php' that do not originate from expected administrative IP addresses.