CVE-2026-56124

phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/shimosyan/phpUploader/commit/45dc4f1c9a2de5ade427deebad0148834c0e8c50
https://github.com/shimosyan/phpUploader/pull/294
https://github.com/shimosyan/phpUploader/releases/tag/v2.0.2
https://www.vulncheck.com/advisories/phpuploader-unauthenticated-database-exposure-via-index-model

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) phpUploader antes de 2.0.2 contiene una vulnerabilidad de revelación de información no autenticada que permite a atacantes remotos acceder al contenido completo de la tabla de la base de datos de archivos subidos al visitar cualquier página de la aplicación. El modelo de índice ejecuta una consulta SELECT sin límites e incrusta el conjunto de resultados completo codificado en JSON en un bloque de script en línea, exponiendo direcciones IP de los cargadores, hashes de clave Argon2ID, nombres de archivo internos y huellas digitales SHA-256.

Information

Published : 2026-06-29 15:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-56124

Mitre link : CVE-2026-56124

CVE.ORG link : CVE-2026-56124

JSON object : View

Products Affected

No product.

CWE

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2026-56124", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56124", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T15:11:40.902142Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/shimosyan/phpUploader", "vendor": "shimosyan", "product": "phpUploader", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.2", "versionType": "semver"}], "packageURL": "pkg:github/shimosyan/phpUploader", "defaultStatus": "affected"}]}], "published": "2026-06-29T15:16:42.217", "references": [{"url": "https://github.com/shimosyan/phpUploader/commit/45dc4f1c9a2de5ade427deebad0148834c0e8c50", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/shimosyan/phpUploader/pull/294", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/shimosyan/phpUploader/releases/tag/v2.0.2", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/phpuploader-unauthenticated-database-exposure-via-index-model", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-359"}, {"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints."}, {"lang": "es", "value": "phpUploader antes de 2.0.2 contiene una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n no autenticada que permite a atacantes remotos acceder al contenido completo de la tabla de la base de datos de archivos subidos al visitar cualquier p\u00e1gina de la aplicaci\u00f3n. El modelo de \u00edndice ejecuta una consulta SELECT sin l\u00edmites e incrusta el conjunto de resultados completo codificado en JSON en un bloque de script en l\u00ednea, exponiendo direcciones IP de los cargadores, hashes de clave Argon2ID, nombres de archivo internos y huellas digitales SHA-256."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "disclosure@vulncheck.com"}