EUVD-2026-34252
GHSA-fpp3-9qqr-4xxm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unrestricted file upload in mjperpinosa's stumasy PHP application allows authenticated remote attackers to upload arbitrary and potentially dangerous file types via the up_file_to_post parameter in add_post.php, enabling likely remote code execution through web shell deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation requiring only low-privilege authentication with no user interaction. A publicly available proof-of-concept exploit exists (disclosed via GitHub issue), and the vendor has not responded to the responsible disclosure - no patch is available at time of analysis.
Technical ContextAI
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), a well-understood PHP application weakness where server-side code fails to validate the content type, extension, or MIME type of user-supplied file uploads. The affected code path is application/PHP/objects/updates/add_post.php, specifically the up_file_to_post argument, which processes file uploads without enforcing restrictions. In PHP applications, this class of vulnerability is severe because successfully uploading a .php file to a web-accessible directory allows direct server-side code execution. The CPE cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:* confirms the wildcard covers all versions of the stumasy application. The project uses a rolling release model, meaning there are no discrete version identifiers to reference for affected-vs-patched determination.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the disclosure filed at https://github.com/mjperpinosa/stumasy/issues/1. As an immediate compensating control, administrators should disable or restrict access to add_post.php via web server configuration (e.g., deny access at the nginx/Apache level to application/PHP/objects/updates/add_post.php), which prevents exploitation entirely but disables the associated post-creation functionality. If the upload feature must remain available, implement server-side file type validation by whitelisting permitted MIME types and extensions (e.g., only image types), and ensure uploaded files are stored outside the web root or in a directory with PHP execution disabled - preventing web shell execution even if a malicious file is uploaded. Restrict the upload endpoint to only the minimum required user roles. Monitor VulDB entry https://vuldb.com/vuln/368254 and the GitHub repository for any upstream patch commits.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today