EUVD-2026-317413

fkie_cve-2026-42569

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

GHSA-fv26-4939-62fh — phpVMS has an /importer authorization bypass causing full database wipe

Affected: Packagist: nabeel/phpvms

# Security Advisory: Unauthenticated Access to Legacy Import Feature

**Severity:** Critical **Affected versions:** phpVMS 7.x (up to 7.0.5) **Fixed in:** v7.0.6 **Component:** Legacy importer

## Summary

A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.

## Impact

A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:

- Data loss - Service disruption

No authentication was required.

## Remediation

- **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7) - If unable to update: - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)

## Affected Versions

* Affected: phpVMS 7.x ≤ 7.0.5 * Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)

Most recent entries from all

EUVD-2026-317413

fkie_cve-2026-42569

GHSA-fv26-4939-62fh — phpVMS has an /importer authorization bypass causing full database wipe