Unrestricted File Upload Vulnerability in JosephChuks File Manager
CVE-2026-95500

6.9MEDIUM

Key Information:

Vendor

Josephchuks

Status
PHP-file-manager-with-code-editor
Vendor
CVE Published:
22 September 2026

What is CVE-2026-95500?

A vulnerability exists in the php-file-manager-with-code-editor where the file_put_contents function in codeEditor.php allows for arbitrary file uploads due to inadequate validation of the filename and content parameters. This flaw enables attackers to upload malicious files remotely, posing a significant risk to server integrity and data security. The vulnerability has been publicly disclosed, and efforts to inform the vendor about the exploit have not received a response.

Affected Version(s)

php-file-manager-with-code-editor 3.0

References

https://vuldb.com/vuln/408348
vdb-entrytechnical-description
https://vuldb.com/vuln/408348/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-95500
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

milocat (VulDB User)
VulDB CNA Team
.