A flaw in SourceCodester’s Onlne Examination & Learning Management System 1.0 allows an attacker to upload files with arbitrary names and extensions because the upload_files.php component calls PHP’s pathinfo() function without sanitizing the result. The uncontrolled filename can be manipulated to store malicious code in a location that the web application may later serve or execute, enabling remote code execution or data exfiltration. The weakness maps to CWE‑434 (Unvalidated File Type) and CWE‑284 (Improper Access Control). Based on the description, it is inferred that authentication is not required to trigger the upload endpoint, meaning that any internet‑reachable user can abuse the flaw.

SourceCodester Onlne Examination & Learning Management System version 1.0 is the only publicly documented release containing the flaw. The vulnerability resides specifically in the upload_files.php file, where the pathinfo() result is used without sanitization. Only deployments running this exact version and without subsequent patches are affected.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple crafted HTTP request to the publicly exposed upload endpoint, where an attacker supplies an arbitrary file name and type. The lack of validation allows the attacker to upload files that may be executed by the web server if the upload directory lacks proper execution restrictions.