Open-source package vulnerability · Composer (PHP)

CVE-2026-42569: phpVMS has an /importer authorization bypass causing full database wipe

criticalCVSS 3.1 9.4GHSA-fv26-4939-62fh

Security Advisory: Unauthenticated Access to Legacy Import Feature Severity: Critical Affected versions: phpVMS 7.x (up to 7.0.5) Fixed in: v7.0.6 Component: Legacy importer Summary A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.

Published May 4, 2026 · Updated May 13, 2026

Affected packages

nabeel/phpvms

Ecosystem: Composer (PHP)
Affected: < 7.0.6
Fixed in: 7.0.6
Check: composer show nabeel/phpvms

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Security Advisory: Unauthenticated Access to Legacy Import Feature

Severity: Critical Affected versions: phpVMS 7.x (up to 7.0.5) Fixed in: v7.0.6 Component: Legacy importer

Summary

A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.

Impact

A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:

Data loss
Service disruption

No authentication was required.

Remediation

Update immediately to the latest patched version
If unable to update:
The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)

Affected Versions

Affected: phpVMS 7.x ≤ 7.0.5
Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)

Credited to peter-bosch.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology