CVE-2026-91005 Details
Description
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
A vulnerability exists in SourceCodester Online Faculty Clearance System version 1.0, specifically within the profile picture upload feature. The issue arises in the file 'production/edit_picture.php', where the function 'move_uploaded_file' is used to handle uploaded files. The vulnerability allows authenticated users to upload arbitrary files by manipulating the 'File' argument, as the application fails to properly validate file extensions, MIME types, or contents. Uploaded files are stored in a web-accessible directory, enabling execution of PHP payloads as web shells.
It is recommended to implement a strict allowlist for file extensions and MIME types, re-encode uploaded files server-side while discarding the original filenames, and store files outside the web root when possible. Additionally, PHP execution should be disabled in upload directories via web server configuration, and server-side authorization and CSRF protection should be enforced on upload actions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zzjzzzj389/cve/issues/1 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-91005 | [email protected] | Permission Required |
| https://vuldb.com/submit/932334 | [email protected] | Permission Required |
| https://vuldb.com/vuln/403588 | [email protected] | Permission Required |
| https://vuldb.com/vuln/403588/cti | [email protected] | Content Wall |
| https://www.sourcecodester.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Online Faculty Clearance System | v1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |