CVE-2026-108922 Details
Description
A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in KusalkaSilva Learning Management System versions prior to commit ffeb873f8803f1e9664384ff75000c7da45466d2. The issue arises in the 'upload_save.php' and 'teacher_avatar.php' files, where the 'getimagesize' function is improperly used. This flaw allows for unrestricted file uploads, as the application only blocks executable files in one of the endpoints. The uploaded files are stored in the 'admin/uploads/' directory, which is accessible via the web, enabling execution of malicious scripts. The vulnerability can be exploited remotely by users with teacher accounts, which can be obtained through a SQL injection in the login process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/KusalkaSilva/Learning-Management-System/ | [email protected] | ProductSource CodeVendor |
| https://github.com/KusalkaSilva/Learning-Management-System/issues/6 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-108922 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/994384 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416735 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416735/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| KusalkaSilva Learning-Management-System | ffeb873f8803f1e9664384ff75000c7da45466d2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |