Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2019-25632: phpFileManager Can Reveal Sensitive Files on Server
CVE-2019-25632 · published 7 months ago
Summary
A security flaw in phpFileManager can allow anyone to access and read files on the server without a password. This is a risk because it could expose sensitive information. Update to a fixed version of phpFileManager to protect your server.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dulldusk | phpfilemanager |
1.7.8 cpe:2.3:a:dulldusk:phpfilemanager:1.7.8:*:*:*:*:*:*:* |
Original advisory text
phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters....
phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published24 Mar 2026
Updated4 Nov 2026
First seen24 Mar 2026
Sources
CVE-2019-25632 · NVD
Track software like this
Free during beta