KusalkaSilva LMS CVE-2026-108922

Exploitation requires an authenticated account (CVSS PR:L) with access to the file-upload workflow handled by upload_save.php, and the attacker must defeat the getimagesize()-based content check by prepending a valid image header/magic bytes to a malicious file supplied in the uploaded_file/image argument. Realistic impact (code execution versus mere file storage) is LIMITED by whether the upload target directory is web-accessible and configured to execute PHP; if uploads are stored outside the web root or served non-executably, impact stays close to the vendor's low rating. Further limiting factors: valid credentials are needed (no unauthenticated path), and the product itself is a niche project with negligible deployment.

Multiple signals point to a LOW real-world priority. The vendor-supplied CVSS 4.0 score is only 2.1, with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N and notably LOW vulnerable-system impacts (VC:L/VI:L/VA:L) - VulDB rated the direct consequence of the upload conservatively rather than as full code execution. PR:L confirms authentication is required, which meaningfully limits the attacker population. The 'E:P' (Proof-of-Concept) exploit-maturity metric aligns with the input signal that publicly available exploit code exists (a GitHub issue), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - this is POC availability, not in-the-wild use. CONFLICT TO NOTE: the weakness class (CWE-434 unrestricted file upload) combined with a getimagesize()-based validation bypass in a PHP application typically enables webshell upload and remote code execution, which would justify HIGH impact - yet the vendor scored impacts only LOW. This discrepancy should be verified against the actual exploit; if the upload directory is web-accessible and executes PHP, real impact is materially higher than the 2.1 score implies. Offsetting all of this, the affected product is an obscure hobby/student project on a rolling release with no responding maintainer, so the practical attack surface across real environments is minimal.

An attacker who holds a low-privilege account on an exposed KusalkaSilva Learning-Management-System instance crafts a malicious file (e.g., a PHP webshell) carrying a valid image header so it passes the getimagesize() check in upload_save.php, then submits it via the uploaded_file/image parameter. If the upload destination is web-reachable and executes PHP, requesting the uploaded file yields remote code execution. A public proof-of-concept exists (published via the project's GitHub issue tracker), lowering the skill barrier.