GHSA-fv26-4939-62fh

# Security Advisory: Unauthenticated Access to Legacy Import Feature

**Severity:** Critical **Affected versions:** phpVMS 7.x (up to 7.0.5) **Fixed in:** v7.0.6 **Component:** Legacy importer

## Summary

A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.

## Impact

A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:

- Data loss - Service disruption

No authentication was required.

## Remediation

- **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7) - If unable to update: - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)

## Affected Versions

* Affected: phpVMS 7.x ≤ 7.0.5 * Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)