The vulnerability identified as CVE-2026-72593 affects dulldusk/phpfm through version 1.8.0. It is classified as CWE-306 (Missing Authentication for Critical Function). Due to the lack of authentication controls, an unauthenticated remote attacker can exploit this vulnerability to gain unrestricted access to the file manager features, enabling full file operations on the server's filesystem. This includes reading sensitive files, modifying or deleting existing files, and uploading arbitrary files, which could lead to complete system compromise. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can remotely and without any authentication perform full file management operations on the affected server. This includes reading sensitive data, modifying or deleting files, and uploading malicious files, potentially leading to full system compromise, data loss, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the phpFM interface to trusted networks or users only, and monitor for unauthorized access attempts. Avoid exposing the phpFM service directly to the internet.