phpVMS < 7.0.6 - Legacy Importer Authorization Bypass

criticalseverity

9.4CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

phpVMS < 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges.

Impact

Unauthenticated attackers can access restricted import functionality, potentially leading to unauthorized data manipulation or system compromise.

Fix

Update to version 7.0.6 or later.

How to confirm it

Send: GET {{BaseURL}}/importer
Positive when: status_code == 200 and contains_all(to_lower(body), "importer", "phpvms") and contains_any(body, "Import Configuration", "Database Config", "Start Importer", "WIPE OUT YOUR EXISTING DATA", "importer/…

Run it with nuclei: nuclei -id CVE-2026-42569 -u <target>

The full check

id: CVE-2026-42569

info:
  name: phpVMS < 7.0.6 - Legacy Importer Authorization Bypass
  author: 0x_Akoko
  severity: critical
  description: |
   phpVMS < 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges.
  impact: |
   Unauthenticated attackers can access restricted import functionality, potentially leading to unauthorized data manipulation or system compromise.
  remediation: |
   Update to version 7.0.6 or later.
  reference:
    - https://github.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fh
    - https://github.com/phpvms/phpvms/commit/f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42569
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
    cvss-score: 9.4
    cve-id: CVE-2026-42569
    epss-score: 0.01173
    epss-percentile: 0.67752
    cwe-id: CWE-284,CWE-306,CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: phpvms
    product: phpvms
    shodan-query: http.html:"phpvms"
    fofa-query: app="phpVMS"
  tags: cve,cve2026,phpvms,auth-bypass,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/importer"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(to_lower(body), "importer", "phpvms")'
          - 'contains_any(body, "Import Configuration", "Database Config", "Start Importer", "WIPE OUT YOUR EXISTING DATA", "importer/config")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from