CVE-2026-90857 Details

A vulnerability exists in SourceCodester College Notes Gallery Management System version 1.0, specifically within the profile upload feature of the file '/dashboard/userprofile.php'. This vulnerability allows authenticated users to upload files with manipulated metadata, bypassing restrictions and enabling the execution of arbitrary code. The issue arises because the application only verifies the MIME type provided by the client, without properly checking the actual content of the file or blocking potentially dangerous file extensions. As a result, an authenticated attacker can upload a PHP file disguised as an image, which is then executed by the server, leading to remote code execution.

To address this vulnerability, it is recommended to validate the actual content of uploaded files on the server side, rather than relying on the client-supplied MIME type. Implement strict controls on allowed file extensions, ensuring that only safe image formats are accepted while rejecting any potentially harmful extensions or filenames. Additionally, store uploaded files in a directory that is not publicly accessible or executable, rename files to remove any attacker-controlled extensions, and configure the web server to prevent execution of scripts in upload directories. Finally, establish logging mechanisms to track upload activities and flag any suspicious files or extension discrepancies.