CVE-2019-25632

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2019-25632

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25632.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-25632

Published

2026-03-24T12:16:03.597Z

Modified

2026-07-08T20:57:06.774528Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fmcurrentdir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.

References

Affected packages

Git / github.com/dulldusk/phpfm

Affected ranges

Type

GIT

Repo

https://github.com/dulldusk/phpfm

Events

Introduced

cfa0ebd05a5c818cb035d576d41a3eb3d2489af9

Last affected

cfa0ebd05a5c818cb035d576d41a3eb3d2489af9

Database specific

{
    "cpe": "cpe:2.3:a:dulldusk:phpfilemanager:1.7.8:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.7.8"
        },
        {
            "last_affected": "1.7.8"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.7.8

v1.*

v1.7.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25632.json"