CVE Intelligence
Analysis AI-assisted

CVE-2026-42569: phpVMS: Improper Access Control Exposes Legacy Import Feature

CVE-2026-42569 affects phpVMS versions prior to 7.0.6, where a critical flaw allowed unauthenticated access to a legacy import feature. The CNA-reported CVSS 3.1 base score is 9.4, and the issue is patched in 7.0.6. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

phpVMS is a PHP application used to run and simulate an airline. According to the CVE record, versions prior to 7.0.6 contain a critical flaw that allowed unauthenticated access to a legacy import feature. The weakness is classified as CWE-284 (Improper Access Control), and the record states that it was patched in version 7.0.6.

Impact

  • The CNA-reported CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, with a base score of 9.4 (critical severity).
  • According to this vector, the flaw is reachable over the network, requires no privileges and no user interaction, and has high impact on integrity and availability and low impact on confidentiality.
  • The record does not detail what data or functions an attacker could reach through the import feature.

Affected products and versions

  • phpVMS versions prior to 7.0.6, as stated in the record description.
  • The record's affected and fixes lists are empty, so version ranges come only from the description.
  • The record lists a release page for 7.0.7 among its references, but does not describe its content.

Exploitation status

The CVE is not listed in the CISA KEV catalog in this record. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update phpVMS to version 7.0.6, which the record identifies as the patched version. Consult the vendor security advisory and the 7.0.6 release.
  • Where an immediate update is not possible, limit network access to the installation and restrict who can reach administrative and import functions until the update is applied.
  • Review the fixing commit to understand the change.

Detection guidance

  • Review web server and application logs for requests to import-related paths from unexpected sources or without a valid session.
  • Check for unexpected changes to airline, pilot or flight data and for import activity that operators do not recognise.
  • Compare the installed version against 7.0.6 to confirm exposure.

Limitations of the available information

  • The record gives no detailed technical description of the flaw, so the exact endpoint and conditions are unknown.
  • The record contains no affected or fixed version lists, and the reported CVSS comes only from the GitHub CNA.
  • It is not stated whether versions 7.0.6 and later were checked for regressions, and the record does not confirm whether any published exploit exists.

Frequently asked questions

Which phpVMS versions are affected by CVE-2026-42569?

According to the record description, phpVMS versions prior to 7.0.6 are affected. The record's affected version list is empty, so no more precise range is confirmed.

Is CVE-2026-42569 known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.