phpVMS has an /importer authorization bypass causing full database wipe
Date: 2026-05
Affected: composer/nabeel/phpvms
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-42569
CWE: CWE-284
CWE-306
CWE-862
CVSS: 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)

# Security Advisory: Unauthenticated Access to Legacy Import Feature **Severity:** Critical **Affected versions:** phpVMS 7.x (up to 7.0.5) **Fixed in:** v7.0.6 **Component:** Legacy importer ## Summary A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational. ## Impact A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in: - Data loss - Service disruption No authentication was required. ## Remediation - **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7) - If unable to update: - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes) ## Affected Versions * Affected: phpVMS 7.x ≤ 7.0.5 * Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)


Mitigations:

Architectural layers (MAESTRO):