Description
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the move_uploaded_file handler within the admin/add_admin.php script of SourceCodester Library Management System 1.0 allows an attacker to upload arbitrary files without restriction. The vulnerability is triggered by manipulating the image upload argument, enabling the placement of executable code on the web server. The potential for remote code execution is inferred from the ability to upload arbitrary code, which could be exploited to compromise confidentiality, integrity, and availability of the system. This vulnerability is classified as CWE-284 and CWE-434.

Affected Systems

The affected system is the SourceCodester Library Management System, version 1.0. Users running this version are susceptible to unrestricted file uploads via the admin add_admin interface.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity and the absence of an EPSS score means exploitation likelihood is not quantified. Because the flaw is remotely exploitable and an exploit has already been released publicly, the risk is significant for organizations that have not applied a fix. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish the attacker’s ability to target this system through the exposed upload endpoint. This flaw is classified as CWE-284 and CWE-434.

Generated by OpenCVE AI on October 13, 2026 at 09:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and install the vendor’s patch or an updated version of the Library Management System that properly validates and restricts uploaded file types.
  • If an immediate patch is unavailable, configure the upload directory to disallow execution of uploaded files and enforce a strict whitelist of allowed MIME types and extensions.
  • Apply directory and file permissions that prevent uploaded files from being accessed as executable code, and consider moving the upload directory outside the web root.

Generated by OpenCVE AI on October 13, 2026 at 09:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Title SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload
First Time appeared Sourcecodester
Sourcecodester library Management System
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:sourcecodester:library_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester library Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Library Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T06:45:19.180Z

Reserved: 2026-10-11T20:05:55.479Z

Link: CVE-2026-108975

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T07:16:31.680

Modified: 2026-10-13T07:16:31.680

Link: CVE-2026-108975

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T09:30:13Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type