The flaw resides in the move_uploaded_file function of filemanager.php and allows an attacker to upload files to the server without restriction, including executable scripts; if such a file can be executed, the attacker can achieve arbitrary code execution on the web server, compromising confidentiality, integrity, and availability. The vulnerability is a classic Access Control flaw (CWE-284) combined with an Unrestricted Upload weakness (CWE-434).

JosephChuks php-file-manager-with-code-editor up to version 3.0 is vulnerable.

The CVSS score of 6.9 categorizes it as a moderate severity vulnerability with a remote attack vector and no authentication requirement. The EPSS score is not available, and it has not been listed in CISA’s KEV catalog, indicating limited public exploitation but still a realistic threat due to the nature of the flaw. An attacker who can remotely access the upload endpoint can upload a malicious payload that may execute if the server’s permissions allow it, turning this into a potential RCE vector. Defenses reduce the risk, but without remediation the exposure remains significant.