A flaw exists in the getimagesize function of the upload_save.php script of the KusalkaSilva Learning‑Management‑System, allowing an attacker to upload arbitrary files without proper type validation. Once an arbitrary file is stored, an attacker could place web‑accessible files that bypass other controls, potentially leading to code execution or other post‑upload attacks. The vulnerability is exploitable remotely with publicly available exploit code.

The affected product is the KusalkaSilva Learning‑Management‑System. The project follows a continuous rolling‑release model, and no specific release is identified as fixed, meaning any current installation that has not incorporated a recent update could be vulnerable.

The CVSS score is 5.3, indicating medium severity, and EPSS information is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw from a remote location without authentication, using the published exploit to upload malicious content that may be executed by the server or processed later by other components. The lack of an official vendor patch and no known workaround increase the risk for running installations that rely on the upload feature.