CVE-2026-56124: phpUploader Unauthenticated Database Disclosure Vulnerability

Technical summary

The vulnerability stems from an unbounded SELECT query in the index model that lacks authentication checks and proper output encoding. The application retrieves the entire uploaded-files database table without pagination or access control, then serializes it as JSON within an inline script block. This design flaw exposes PII and authentication material (Argon2ID-hashed credentials), internal file metadata, and SHA-256 fingerprints to any unauthenticated visitor. The issue affects the core routing logic, meaning it is triggered by normal application browsing without special payloads or manipulation.

Business impact

Organizations using phpUploader face immediate reputational and regulatory risk. Exposure of uploader IP addresses and password hashes can facilitate account compromise attempts and enable threat actors to profile infrastructure and users. Leakage of internal filenames and checksums may reveal business logic, document structures, or intellectual property. For applications handling regulated data (PII, payment info, health records), this vulnerability likely violates GDPR, HIPAA, PCI-DSS, and similar regimes, triggering breach notification and potential fines. Customer trust and competitive position are at stake if file metadata is harvested by competitors or malicious actors.

Affected systems

All versions of phpUploader prior to 2.0.2 are vulnerable. Any deployment of the affected software that is internet-reachable or accessible to untrusted network segments is at risk. The vulnerability does not require specific configuration; it is present by default in the index model logic.

Exploitability

Exploitability is trivial. An unauthenticated attacker requires only a network path to the application and can retrieve the full exposed dataset by visiting the application homepage or any standard page. No authentication, elevated privileges, user interaction, or specialized tools are necessary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects this: network-accessible, low complexity, no prerequisites. An attacker can automate discovery and harvesting using basic HTTP clients. This is a high-severity concern precisely because the barrier to exploitation is nearly zero.

Remediation

Upgrade phpUploader to version 2.0.2 or later immediately. The patched version corrects the index model to enforce authentication, implement query pagination, and sanitize or remove sensitive fields from client-side output. If immediate patching is not possible, apply compensating controls: restrict network access to the phpUploader application via firewall rules, Web Application Firewall (WAF) rules, or reverse proxy authentication; implement rate limiting and IP whitelisting; and monitor access logs for anomalous data extraction patterns. However, patching is the only complete fix.

Patch guidance

Verify the installed phpUploader version against your vendor's advisory. Download version 2.0.2 or later from the official phpUploader repository or vendor website. Before deploying to production, test the patch in a staging environment to confirm compatibility with any custom extensions or integrations. Review the patch release notes for any breaking changes or configuration updates. Once applied, restart or redeploy the application and confirm that the index model now requires authentication and no longer embeds database records in client-side scripts.

Detection guidance

Monitor HTTP access logs for requests to the application index or homepage paths, looking for repeated visits from the same source IP or rapid sequential requests that suggest automated harvesting. Inspect application responses for the presence of JSON-encoded file metadata in inline script blocks—this is a strong indicator of the vulnerability. Network IDS/IPS rules should flag responses containing Base64-encoded or plaintext Argon2ID hash patterns. Web application firewalls can detect and block requests that attempt to exfiltrate file metadata. Additionally, review uploaded-files database access logs for unusual SELECT queries without WHERE clauses or pagination limits. If the application has been running vulnerable code, assume the uploaded-files table contents have been disclosed and conduct forensic review of access patterns.

Why prioritize this

This vulnerability merits immediate remediation due to its combination of high CVSS score (7.5), unauthenticated access, trivial exploitability, and direct exposure of sensitive data including credentials and PII. The lack of user interaction or special conditions means any internet-facing phpUploader instance is actively at risk. The exposure of password hashes and IP addresses creates secondary attack surface. Regulatory compliance and customer trust depend on swift remediation.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required (AV:N, PR:N, UI:N), low attack complexity (AC:L), and high confidentiality impact (C:H). Integrity and availability are not affected, which prevents a CRITICAL rating. However, the ubiquity of file upload functionality and the direct exposure of authentication material and PII justify the HIGH severity rating and warrant treatment as a critical priority for affected organizations.

Frequently asked questions