An unrestricted file upload flaw in dulldusk/phpfm allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. Because the default configuration ships with an empty upload extension filter and no password protection, an unauthenticated attacker can place a PHP webshell in the upload directory and then execute it by browsing to the uploaded path. This enables remote code execution, giving an attacker full control over the system, and exemplifies CWE-434: Unrestricted Upload of File with Dangerous Type.

The affected product is dulldusk/phpfm up to and including version 1.8.0. All installations that have not applied a patch or upgrade beyond 1.8.0 are vulnerable. No other versions or vendors were listed in the CVE data.

The CVSS score of 9.8 indicates critical severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and the simple upload mechanism means an attacker can attain remote code execution by merely sending a crafted HTTP request. Because the flaw is remote and requires no special privileges or pre‑existing account, the likelihood of exploitation is high in environments where phpFM is exposed to the Internet.