CVE-2026-7107 Details
Description
A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
A vulnerability allowing arbitrary file uploads has been identified in Code-Projects Invoice System version 1.0. The issue arises in the company logo upload feature, where the validation process is bypassed due to a discrepancy between the expected and actual form field names. This flaw enables remote attackers to upload files of any type, including PHP scripts, to a public directory without being subjected to the intended image validation. Exploitation of this vulnerability could lead to remote code execution.
It is recommended to fix the validation logic to ensure that the upload rules correctly match the form field names. Additionally, implement strict MIME type validation for image uploads and consider storing uploaded files in a secure location, such as 'storage/app/public', using the Storage facade to manage file visibility.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code-projects.org/ | [email protected] | Vendor |
| https://gist.github.com/higordiego/ea5944bd29cffee1162491d60ed5785a | [email protected] | ExploitTechnical Description |
| https://vuldb.com/submit/800690 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359708 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/359708/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code-projects Invoice System in Laravel | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |