An arbitrary file upload vulnerability exists in the profile picture upload feature of Phpgurukul Online Course Registration version 3.1, accessible through the /my-profile.php page. The flaw allows a user to upload any file type without restriction, creating a risk that malicious files can be stored on the server. If the application or server later processes the uploaded file in a way that permits execution, the attacker could inject code, compromise the application, or tamper with stored data.

The vulnerability affects installations of Phpgurukul Online Course Registration version 3.1. Users who have deployed this version should assess whether the application is reachable via the public internet or internal networks and consider whether any access controls are in place for the profile picture upload area.

The flaw is remotely exploitable through the web interface; an attacker only needs the ability to submit a file via the upload form on /my-profile.php. The CVSS score is 8.8, indicating high severity, while the EPSS score remains below 1% and the vulnerability is not listed in KEV. The nature of unrestricted file upload indicates that the vulnerability could enable severe impacts if the uploaded content is executed or processed improperly. Until an official patch is released, systems running the vulnerable application remain at risk.