CVE-2026-42569 — Vulnerability in nabeel/phpvms — CVE Details

# Security Advisory: Unauthenticated Access to Legacy Import Feature **Severity:** Critical **Affected versions:** phpVMS 7.x (up to 7.0.5) **Fixed in:** v7.0.6 **Component:** Legacy importer ## Summary A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational. ## Impact A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in: - Data loss - Service disruption No authentication was required. ## Remediation - **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7) - If unable to update: - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes) ## Affected Versions * Affected: phpVMS 7.x ≤ 7.0.5 * Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)