CVE-2026-72592 is an unrestricted file upload vulnerability in dulldusk/phpfm through version 1.8.0. The application ships with an empty upload extension filter and no authentication enabled by default (auth_pass is an empty string). This configuration allows unauthenticated remote attackers to upload arbitrary PHP files, such as webshells, and execute them by browsing to the uploaded file location, leading to full server compromise. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 3.1 score of 9.8 (critical). No official patch or remediation level is currently documented.

An unauthenticated attacker can upload and execute arbitrary PHP code on the server running dulldusk/phpfm, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This includes the ability to execute arbitrary commands, access sensitive data, and disrupt service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the application, enable authentication, and configure upload filters to prevent uploading executable files. Avoid exposing the upload directory to public access. Monitor for suspicious uploads and activity related to file execution.