8.6
CVSS 4.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с администраторски права и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
Засегнати продукти
- volmarg personal-management-system: до 2.1.0
Вид слабост
История
- 3 ноември 2026 Публикувано
Други уязвимости в volmarg personal-management-system
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-73328
- https://nvd.nist.gov/vuln/detail/CVE-2026-73328
- https://github.com/Volmarg/personal-management-system/issues/167
- https://github.com/Volmarg/personal-management-system
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67
- https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send