CVE-2026-56124 affects phpUploader before version 2.0.2. The vulnerability allows unauthenticated remote attackers to retrieve the full contents of the uploaded-files database table by visiting any page of the application. This occurs because the index model performs an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block. As a result, sensitive information including uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints are exposed to unauthorized actors. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Exposure of private personal information such as uploader IP addresses, password hashes (Argon2ID), internal filenames, and file fingerprints (SHA-256) to unauthenticated remote attackers. This can lead to privacy violations and potential further attacks leveraging disclosed sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the provided data, users should monitor the vendor's communications for updates. Until a fix is available, restricting public access to the application or disabling the vulnerable functionality may reduce exposure.