CVE-2026-56124 Details
Description
phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.
A vulnerability allowing unauthenticated information disclosure has been identified in phpUploader versions prior to 2.0.2. This vulnerability enables remote attackers to access the complete contents of the uploaded-files database table by simply visiting any page of the application. The issue arises because the index model performs an unbounded SELECT query, embedding the entire JSON-encoded result set into an inline script block. This exposure includes uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.
Users can upgrade to phpUploader version 2.0.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shimosyan/phpUploader/commit/45dc4f1c9a2de5ade427deebad0148834c0e8c50 | [email protected] | Source CodeVendor |
| https://github.com/shimosyan/phpUploader/pull/294 | [email protected] | Issue TrackingVendor |
| https://github.com/shimosyan/phpUploader/releases/tag/v2.0.2 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/phpuploader-unauthenticated-database-exposure-via-index-model | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | [email protected] |
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpUploader | < 2.0.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |