CVE-2026-56124 affects phpUploader prior to version 2.0.2. The vulnerability arises because the index model executes an unbounded SELECT query on the uploaded-files database table and embeds the entire JSON-encoded result set in an inline script block on any page. This results in unauthenticated remote attackers being able to retrieve sensitive information such as uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints. The vulnerability does not require authentication, user interaction, or privileges, and has a high impact on confidentiality.

The vulnerability allows complete disclosure of sensitive personal and system information stored in the uploaded-files database table without any authentication. This includes IP addresses of uploaders, cryptographic key hashes (Argon2ID), internal filenames, and file fingerprints (SHA-256). Such exposure can lead to privacy violations and potentially aid further attacks targeting the system or its users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restricting public access to the application or disabling the vulnerable functionality may reduce exposure.