This vulnerability affects the Save Handler component of JosephChuks php-file-manager-with-code-editor up to and including version 3.0. The issue arises from improper validation or sanitization of the filename and content parameters passed to the file_put_contents function in codeEditor.php, enabling an attacker to upload arbitrary files remotely without restriction. The exploit has been publicly disclosed, increasing the risk of exploitation. The vendor was notified but has not provided any response or remediation.

Successful exploitation allows remote attackers to upload arbitrary files to the server, potentially leading to unauthorized code execution, data compromise, or system takeover depending on the uploaded content and server configuration. The vulnerability is remotely exploitable without authentication and requires no user interaction.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's channels for any forthcoming updates. Until a patch is released, consider restricting access to the vulnerable component, implementing web application firewall rules to block suspicious upload attempts, or disabling the affected functionality if feasible.