EIP-2026-111046

PRE-CVE

phpFileManager 0.9.8 - Remote Command Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-111046. PoCs published by hyp3rlinx.

AI-analyzed exploit summary The exploit demonstrates a remote command execution vulnerability in phpFileManager 0.9.8 by injecting OS commands via the 'cmd' parameter in a GET request. The PoC includes URLs that execute 'cmd.exe' and 'calc.exe' on a Windows system.

Description

phpFileManager 0.9.8 - Remote Command Execution

Exploits (1)

exploitdb WORKING POC VERIFIED
by hyp3rlinx · textwebappsphp
https://www.exploit-db.com/exploits/37709

The exploit demonstrates a remote command execution vulnerability in phpFileManager 0.9.8 by injecting OS commands via the 'cmd' parameter in a GET request. The PoC includes URLs that execute 'cmd.exe' and 'calc.exe' on a Windows system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: phpFileManager 0.9.8
No auth needed
Prerequisites: Victim must visit a malicious link or website containing the crafted URL
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026