EUVD-2026-34253
GHSA-hv9x-95wf-v38q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unrestricted file upload in Stumasy (mjperpinosa) allows a low-privileged authenticated attacker to upload arbitrary files through the profile image change endpoint, potentially enabling server-side code execution. The vulnerable parameter pr_profile_image in application/PHP/objects/profiles/change_profile_image.php performs no meaningful file type validation, making it trivial to submit non-image payloads including PHP webshells. A publicly available exploit exists via the project GitHub issue tracker; the vendor has not responded to the disclosure, and no patch has been released. No CISA KEV listing at time of analysis.
Technical ContextAI
Stumasy is a PHP-based web application identified by CPE cpe:2.3:a:mjperpinosa:stumasy:*:*:*:*:*:*:*:*. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of vulnerability where an application fails to validate that uploaded files conform to an expected, safe type before storing them. In PHP applications, this is particularly severe: if the web server serves uploaded files from a publicly accessible directory and the upload path is guessable or disclosed, an attacker can upload a .php webshell and trigger its execution via a direct HTTP request. The affected function handles profile image replacement, a common feature that is frequently under-validated. The CVSS vector AV:N/AC:L/PR:L confirms the attack is network-reachable with low complexity once a user account is obtained.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the disclosure. As an immediate compensating control, administrators should disable or restrict access to the profile image upload functionality by removing or access-controlling the endpoint application/PHP/objects/profiles/change_profile_image.php - this prevents exploitation at the cost of disabling the profile image change feature entirely. If the upload feature must remain active, implement server-side file type validation using a strict allowlist of safe MIME types (e.g., image/jpeg, image/png, image/gif) and enforce file extension checks independently of the Content-Type header, as client-supplied headers are attacker-controlled. Additionally, ensure the upload destination directory is not web-accessible or is configured with execution disabled (e.g., php_flag engine off in Apache or location blocks in nginx), which prevents uploaded PHP files from being executed even if bypassed. Monitor VulDB advisory https://vuldb.com/vuln/368255 and the GitHub repository for any upstream fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today