CVE-2026-72593: Dulldusk Phpfm

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.

Affected products

• Dulldusk Phpfm: up to and including 1.8.0

Published 2026-08-10. Last modified 2026-08-28.