{"id":"CVE-2026-42569","aliases":["EUVD-2026-28930","GHSA-fv26-4939-62fh"],"status":"published","title":"phpvms: /importer authorization bypass causing full database wipe","description":"phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01173,"percentile":0.67715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-284","CWE-306","CWE-862"],"published":"2026-05-04T21:20:40Z","modified":"2026-10-28T02:30:59Z","exploits":[{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-42569","title":"ashrafzaryouh/CVE-2026-42569","date":"2026-05-11","url":"https://github.com/ashrafzaryouh/CVE-2026-42569"},{"source":"nuclei","id":"CVE-2026-42569","title":"phpVMS \u003c 7.0.6 - Legacy Importer Authorization Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42569.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"nabeel/phpvms","fixed_in":["7.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"nabeel/phpvms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"nabeel/phpvms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.6"}]}],"versions":["7.0.0","7.0.0-beta.2","7.0.0-beta.3","7.0.0-beta.4","7.0.0-beta.5","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","v7.0.0-alpha2","v7.0.0-beta"]}],"products":[{"vendor":"phpvms","product":"phpvms"}],"references":[{"url":"https://github.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fh","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/phpvms/phpvms/commit/f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/phpvms/phpvms/releases/tag/7.0.6","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/phpvms/phpvms/releases/tag/7.0.7","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42569","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fv26-4939-62fh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42569.json","tags":["advisory"]},{"url":"https://github.com/phpvms/phpvms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42569","title":"phpvms: /importer authorization bypass causing full database wipe","description":"phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.","status":"published","published":"2026-05-09T19:21:48.592Z","modified":"2026-05-12T18:31:04.998Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-284","CWE-306","CWE-862"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-28930","description":"phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.","status":"published","published":"2026-05-09T19:21:48Z","modified":"2026-05-12T18:31:04Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:04:36.64757Z"}],"ghsa":[{"id":"GHSA-fv26-4939-62fh","title":"phpVMS has an /importer authorization bypass causing full database wipe","description":"# Security Advisory: Unauthenticated Access to Legacy Import Feature\n\n**Severity:** Critical\n**Affected versions:** phpVMS 7.x (up to 7.0.5)\n**Fixed in:** v7.0.6\n**Component:** Legacy importer\n\n## Summary\n\nA critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.\n\n## Impact\n\nA remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:\n\n- Data loss\n- Service disruption\n\nNo authentication was required.\n\n## Remediation\n\n- **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7)\n- If unable to update:\n  - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)\n\n## Affected Versions\n\n* Affected: phpVMS 7.x ≤ 7.0.5\n* Not affected: phpVMS \u003e= 7.0.6, v8 (feature removed from public access)","status":"published","published":"2026-05-04T21:20:40Z","modified":"2026-05-13T13:42:26Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"cwes":["CWE-284","CWE-306","CWE-862"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-42569","description":"phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.","status":"published","published":"2026-05-09T20:16:29.127Z","modified":"2026-07-20T20:10:00.11Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-284","CWE-306","CWE-862"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-42569","title":"phpvms: /importer authorization bypass causing full database wipe","description":"phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.","status":"published","published":"2026-05-09T19:21:48.592Z","modified":"2026-10-28T02:30:59.809528561Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"cwes":["CWE-284","CWE-306","CWE-862"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-fv26-4939-62fh","title":"phpVMS has an /importer authorization bypass causing full database wipe","description":"# Security Advisory: Unauthenticated Access to Legacy Import Feature\n\n**Severity:** Critical\n**Affected versions:** phpVMS 7.x (up to 7.0.5)\n**Fixed in:** v7.0.6\n**Component:** Legacy importer\n\n## Summary\n\nA critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.\n\n## Impact\n\nA remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:\n\n- Data loss\n- Service disruption\n\nNo authentication was required.\n\n## Remediation\n\n- **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7)\n- If unable to update:\n  - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)\n\n## Affected Versions\n\n* Affected: phpVMS 7.x ≤ 7.0.5\n* Not affected: phpVMS \u003e= 7.0.6, v8 (feature removed from public access)","status":"published","published":"2026-05-04T21:20:40Z","modified":"2026-05-13T13:54:44.258293Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"cwes":["CWE-284","CWE-306","CWE-862"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}