CVE-2026-72593

phpfm through 1.8.0 has a missing authentication vulnerability that allows an unauthenticated remote attacker to access the full file manager functionality, including reading, writing, deleting, and uploading files anywhere on the server filesystem.

Complete server compromise, including access to all files and the ability to modify or delete them, potentially leading to data breach and server takeover.

Enable authentication in phpFM and update to a patched version.