CVE-2026-7238 Details

A vulnerability allowing arbitrary file upload has been identified in Code-Projects Online Music Site version 1.0. The issue resides in the AdminUpdateAlbum.php file, where the txtimage argument can be manipulated to bypass file type restrictions. This flaw enables remote exploitation, allowing attackers to upload malicious files, such as scripts, which can be executed to gain control over the server, steal data, or initiate further attacks, posing a significant threat to system security.

No specific remediation is known, but it is recommended to implement file type validation that checks the actual content of files rather than relying solely on HTTP headers. Additionally, uploaded files should be stored in a directory not accessible from the web, and file names should be sanitized to prevent execution of malicious scripts.