Security Advisory: Unauthenticated Access to Legacy Import Feature

Severity: Critical Affected versions: phpVMS 7.x (up to 7.0.5) Fixed in: v7.0.6 Component: Legacy importer

Summary

A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.

Impact

A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:

• Data loss
• Service disruption

No authentication was required.

Remediation

• Update immediately to the latest patched version
• If unable to update:
  • The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)

Affected Versions

• Affected: phpVMS 7.x ≤ 7.0.5
• Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)