Description
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-30
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Unrestricted File Upload
Action: Find Fix
AI Analysis

Impact

A flaw in the admin/add_logs.php script of cak-filemanagement-system corresponds to a CWE-434 (Unrestricted File Upload) and a CWE-284 (Improper Access Control) weakness. The attacker can invoke move_uploaded_file with an arbitrary file path, allowing unrestricted upload. The vulnerability is exploitable from a remote location and can be used to place malicious files on the server. If the uploaded file contains executable code, the attacker could gain code execution or elevate privileges, threatening confidentiality, integrity, and availability of the affected system.

Affected Systems

The vulnerability affects the cak‑filemanagement‑system, versions up to commit 5e6433246475e66462e1fea980688de96a049297. Users of earlier releases that have not applied this patch are susceptible.

Risk and Exploitability

The CVSS v3 score of 6.9 indicates a moderate impact and medium‑to‑high risk. EPSS data is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploit activity yet, but the issuer’s public disclosure indicates that an attacker can use the flaw.

Generated by OpenCVE AI on October 30, 2026 at 20:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict file upload types by implementing server‑side validation to accept only approved extensions (e.g., .txt, .pdf).
  • Sanitize file paths to prevent directory traversal and disallow arbitrary file paths in move_uploaded_file.
  • Move the upload directory outside the document root or configure it with no execution permissions, applying strict directory permissions to prevent execution of uploaded files. (The goal is to deny execution of malicious uploads.)
  • If possible, upgrade to the latest commit (5e6433246475e66462e1fea980688de96a049297) or apply any vendor‑issued patch once available.

Generated by OpenCVE AI on October 30, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title 37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload
First Time appeared 37954679
37954679 cak-filemanagement-system
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:37954679:cak-filemanagement-system:*:*:*:*:*:*:*:*
Vendors & Products 37954679
37954679 cak-filemanagement-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

37954679 Cak-filemanagement-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-30T18:34:44.346Z

Reserved: 2026-10-30T12:37:12.370Z

Link: CVE-2026-119620

cve-icon Vulnrichment

Updated: 2026-10-30T18:28:58.132Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T18:17:26.463

Modified: 2026-10-30T19:22:27.173

Link: CVE-2026-119620

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T20:30:14Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type