This critical vulnerability in dulldusk phpfm allows unauthenticated remote attackers to achieve full system compromise through arbitrary code execution.

The application fails to implement file extension filtering and lacks default authentication, permitting an unauthenticated attacker to upload and execute malicious PHP webshells directly on the server.

The CVSS score of 9.8 reflects the high potential for total system takeover. Successful exploitation grants an attacker full control over the host, leading to sensitive data exfiltration, permanent data loss, and the potential for the server to be used as a pivot point for further lateral movement within the network.

Immediate Action: Upgrade to the latest available version of phpfm immediately to implement necessary file upload restrictions and authentication requirements.

Proactive Monitoring: Inspect web server access logs for requests to non-standard PHP files or unauthorized access to the file manager directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming requests and block suspicious file upload patterns or direct access to known executable directories.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability, administrators should prioritize an immediate update. If an update cannot be applied instantly, the application should be taken offline or access should be restricted to trusted IP addresses until a secure configuration is verified.