A local file inclusion vulnerability in phpFileManager 1.7.8 permits unauthenticated users to read any file on the server by manipulating the action, fm_current_dir, and filename parameters in index.php. This flaw allows attackers to download sensitive files such as /etc/passwd by issuing crafted GET requests, exposing confidential data and providing a foothold for further exploitation.

The flaw affects the Sourceforge phpFileManager 1.7.8 release. No other versions or builds are listed as vulnerable in the available data.

With a CVSS score of 6.9, the severity is moderate but noteworthy. Exploitation requires only a web request with specific parameters, meaning any host running the vulnerable package is at risk without authentication. The EPSS score is unavailable, and the vulnerability is not in the CISA KEV catalog, but its relative ease of exploitation makes it a practical threat for attackers scanning web applications.