Description
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-22
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution via Unrestricted File Upload
Action: Patch Immediately
AI Analysis

Impact

The flaw resides in the file_put_contents call within the codeEditor.php file of the Save Handler component, allowing an attacker to supply arbitrary filenames and content. This results in unrestricted file upload capability, which can be used to place malicious scripts on the server and subsequently execute them. The weakness is classified under CWE-284 and CWE-434 and presents a remote code execution risk.

Affected Systems

JosephChuks php-file-manager-with-code-editor versions up to 3.0 are vulnerable. No patch information is currently available from the vendor, and the vulnerability applies to all installations of these versions.

Risk and Exploitability

The CVSS base score is 6.9, indicating a moderate impact. EPSS is not available, making it unclear how frequently this flaw is exploited in the wild. The vulnerability is not listed in CISA's KEV catalog. Because the attack vector is remote and the vendor has not released a fix, any system that accepts uploads may be affected if the component is deployed without additional mitigations.

Generated by OpenCVE AI on September 22, 2026 at 16:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply an official patch or upgrade to a newer, fixed version of JosephChuks php-file-manager-with-code-editor.
  • If no patch exists, implement strict file type validation and reject dangerous file extensions before uploading.
  • Store uploaded files outside of the web‑accessible directory and configure the web server so that uploaded files cannot be executed.
  • Enable logging and monitor for suspicious upload activity.

Generated by OpenCVE AI on September 22, 2026 at 16:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload
First Time appeared Josephchuks
Josephchuks php-file-manager-with-code-editor
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:josephchuks:php-file-manager-with-code-editor:*:*:*:*:*:*:*:*
Vendors & Products Josephchuks
Josephchuks php-file-manager-with-code-editor
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Josephchuks Php-file-manager-with-code-editor
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-22T15:37:44.241Z

Reserved: 2026-09-22T06:29:04.083Z

Link: CVE-2026-95500

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-22T15:17:25.197

Modified: 2026-09-22T16:18:18.457

Link: CVE-2026-95500

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T17:30:18Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type