The vulnerability is an unrestricted upload flaw in the student‑management‑system, located in the RegisterService.php handler for the registration endpoint. By manipulating the stimg argument, an attacker can upload any file type to the server. Because the upload is not subject to type checks or size limits, a malicious payload could be placed in a location where it might be executed or used to expose sensitive data, potentially leading to code execution or other integrity violations.

This issue affects all releases of the Kushan2k student‑management‑system up to the revision f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. The project employs a rolling release model, so specific fixed versions are not yet published. Administrators who run any instance of the application may be vulnerable.

The CVSS score of 6.9 indicates moderate to high severity. An attacker can trigger the flaw remotely via the public registration endpoint, and a proof‑of‑concept exploit has already been released. No EPSS data is available and the vulnerability is not yet listed in the CISA KEV catalog. Because the upload is unrestricted, the success of an attack largely depends on whether the web server is configured to execute uploaded files; if execution is possible, the impact could be equivalent to remote code execution.