This vulnerability affects JosephChuks php-file-manager-with-code-editor up to and including version 3.0. The issue lies in the move_uploaded_file function in filemanager.php, where manipulation of the files argument can result in unrestricted file uploads. This flaw allows remote attackers to upload arbitrary files, potentially leading to further compromise. The vendor was contacted early but did not respond, and no official patch or remediation has been published.

The vulnerability allows remote attackers to upload files without restriction, which could lead to unauthorized file placement on the server. This may enable attackers to execute arbitrary code or conduct other malicious activities depending on the server configuration and file handling. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should consider disabling or restricting file upload functionality until a fix is provided. Implementing additional access controls or input validation on uploaded files may help mitigate risk temporarily.