CVE-2025-70457

CRITICAL
2026-01-23 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Jan 30, 2026 - 17:59 vuln.today
Public exploit code
CVE Published
Jan 23, 2026 - 22:16 nvd
CRITICAL 9.8

Tags

PHP RCE Modern Image Gallery App

Description

A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file contents. Additionally, the application preserves the user-supplied file extension during the save process. This allows an unauthenticated attacker to upload arbitrary PHP code by spoofing the MIME type as an image, leading to full system compromise.

Analysis

Sourcecodester Modern Image Gallery App v1.0 has an arbitrary file upload in the gallery endpoint allowing unauthenticated remote code execution.

Technical Context

The gallery/upload endpoint in Modern Image Gallery App v1.0 has a CWE-434 unrestricted file upload that accepts PHP files, which are then accessible and executable through the web server.

Affected Products

['Sourcecodester Modern Image Gallery App v1.0']

Remediation

Do not use this application in production. If deployed, restrict file upload types and disable PHP execution in upload directories.

Priority Score

69
Low Medium High Critical
KEV: 0
EPSS: +0.3
CVSS: +49
POC: +20

Share

CVE-2025-70457 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy