---
id: CVE-2026-95500
title: >-
  A vulnerability has been found in JosephChuks
  php-file-manager-with-code-editor up to 3.0
summary: >-
  A vulnerability has been found in JosephChuks
  php-file-manager-with-code-editor up to 3.0. Impacted is the function
  file_put_contents of the file codeEditor.php of the component Save Handler.
  The manipulation of the argument filename/con…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-284
  - CWE-434
vendor: JosephChuks
product: php-file-manager-with-code-editor
affected:
  - php-file-manager-with-code-editor 3.0
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:04:55.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95500'
references:
  - url: 'https://vuldb.com/cve/CVE-2026-95500'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/896602'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408348'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408348/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T14:49:41.087588Z'
ingestedAt: '2026-09-22T15:05:01.089Z'
epss: 0.00472
epssPercentile: 0.38219
---

## Overview

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.