phpUploader before version 2.0.2 does not require authentication to view any page of the application, and the index model performs an unbounded SELECT query that embeds the entire uploaded‑files database table as JSON in an inline script block. The disclosed data includes uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA‑256 fingerprints, exposing sensitive information and key material (CWE‑359 and CWE‑497).

The vulnerability affects all installations of shimosyan:phpUploader running a version older than 2.0.2, as released prior to the 2.0.2 security fix.

The CVSS score of 8.7 indicates a high likelihood of serious confidentiality loss. Because the EPSS score is not available, the exact exploitation probability cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog, but the web‑based, unauthenticated nature of the flaw means a remote attacker can easily trigger the exposure by simply requesting any page of the application.