Security readout for executives and security teams
Plain-English summary
phpfm can expose its complete file-management interface without requiring a login. An attacker who can reach an affected deployment could view sensitive information, alter or destroy files, and upload new content. This creates an immediate risk of server compromise, data loss, service disruption, and further access using credentials found in stored files.
Executive priority
Treat reachable deployments as an emergency remediation item. Identify and restrict them immediately, then investigate exposed systems for unauthorized activity. Prioritize internet-facing instances and systems holding credentials, customer data, application source, or operational files. Do not assume a deployment is safe solely because its version metadata does not match the bundle's inconsistent structured version entry.
Technical view
CVE-2026-72593 is a CWE-306 missing-authentication flaw reported in dulldusk/phpfm through 1.8.0. It is remotely reachable, requires no privileges or user interaction, and exposes file reading, writing, deletion, and upload functionality. The supplied CVSS 3.1 score is 9.8. Actual filesystem reach may depend on the web process's operating-system permissions.
Likely exposure
Highest risk applies where phpfm is reachable from the internet or an untrusted network without an independent authentication control. Internal deployments remain dangerous if reachable by compromised users or systems. The structured affected-version entry is inconsistent with the description, so organizations should inventory every phpfm deployment rather than rely narrowly on version matching.
Exploitation context
The bundle provides no evidence of active exploitation, and the CVE is not identified as present in KEV. Exploitation would nevertheless have low prerequisites because the vulnerable file manager reportedly requires neither authentication nor user interaction. Successful access could directly affect confidentiality, integrity, and availability.
Researcher notes
The public description names versions through 1.8.0, but the structured affected entry lists only version "0" with unknown default status. No patched release or vendor mitigation is supplied. Scope and remediation therefore require confirmation from current project or CVE guidance. The impact claim covers full file-manager operations; practical filesystem boundaries may depend on runtime permissions.
Mitigation direction
- Remove or disable phpfm wherever it is unnecessary.
- Block untrusted access using existing web-server, identity, or network controls.
- Check the project and CVE records for updated vendor remediation guidance.
- Minimize the web process's filesystem permissions and access to sensitive directories.
- If compromise is suspected, isolate the server and rotate potentially exposed credentials.
Validation and detection
- Inventory all servers, containers, and published routes for phpfm deployments.
- Confirm each deployment is inaccessible to unauthenticated and untrusted users.
- Review configuration and application code for an effective authentication control.
- Inspect access logs for unexpected file-manager requests or unfamiliar source addresses.
- Check filesystem integrity for unauthorized uploads, modifications, or deletions.
- Verify the web process cannot access unnecessary sensitive paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-72593 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9TuranSecVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineTuranSec
CVE Reserved
- Source timelineTuranSec
Public Disclosure
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ProductCVE reference, TuranSec · third-party-advisory
- Vulnerable FileCVE reference, TuranSec · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.