CVE-2019-25632: dulldusk phpfilemanager

Vulnerability summary

CVE-2019-25632 is a medium (CVSS 6.9) vulnerability in dulldusk phpfilemanager. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-03-2026
   PublishedVulnerability first disclosed.
2. 26-03-2026
   Last modifiedVulnerability information updated.

Description

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.