CVE-2026-5576 Details

A vulnerability allowing unrestricted file uploads has been identified in SourceCodester's Personnel Record Management System version 1.0. The issue resides in the 'Add Employee' page, specifically within the 'save_emp.php' file. This flaw enables remote exploitation by bypassing file type validations and authorization checks, allowing attackers to upload malicious WebShell scripts to the server. Once uploaded, these scripts can be executed with server-level privileges, leading to full remote code execution. This exploitation could result in unauthorized execution of system commands, modification of server settings, theft of sensitive business information, deployment of ransomware or cryptominers, and potential lateral movement to compromise other servers on the internal network.

It is recommended to implement strict file upload validations, including server-side whitelisting of allowed file types, rigorous MIME type checks, and random renaming of uploaded files to prevent execution of scripts. Additionally, monitor for and apply any security patches released by the developers.