Unauthenticated Information Disclosure in phpUploader by Shimosyan

CVE-2026-56124

What is CVE-2026-56124?

phpUploader versions prior to 2.0.2 suffer from an unauthenticated information disclosure vulnerability. This flaw allows remote attackers to access sensitive data stored in the uploaded-files database table by simply visiting any page within the application. The vulnerability arises due to the index model executing an unbounded SELECT query, which leads to the complete JSON-encoded result set being embedded in an inline script block. This, in turn, exposes critical information, including uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints. It poses significant risks for data privacy and system integrity, making it imperative for users to upgrade to the patched version.

References