Contact Tracing System CVE-2026-108973

Exploitation targets the save handler at /classes/Users.php?f=save, specifically the img/id file parameter passed to move_uploaded_file without extension or MIME/content validation, permitting upload of executable PHP into a web-reachable path. Per the provider CVSS vector (PR:N/UI:N) no authentication or user interaction is required, implying the upload path is reachable pre-auth against a default install of SourceCodester Contact Tracing System 1.0; however the endpoint name (Users save) suggests it may be intended for an authenticated admin context, so the pre-auth assumption should be verified in source. Limiting factors: successful code execution requires the upload directory to be web-accessible and PHP execution enabled there, and only version 1.0 of this specific product is affected.

Signals are moderately strong but partially conflicting. The provider CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, yet rates impact only Low across VC/VI/VA (score 6.9) - unusual for CWE-434 unrestricted upload, which typically yields webshell-based remote code execution and therefore High impact. The 'E:P' exploit-maturity metric plus the VulDB POC flag confirm publicly available exploit code exists, and one reference (tracexlabs) explicitly characterizes this as pre-auth RCE, further suggesting the official Low impact rating understates real severity. No EPSS score and no CISA KEV entry were provided, so active exploitation cannot be asserted - this is POC-available, not confirmed in-the-wild. Net: the vulnerability class and low attack barrier make it a genuine priority for anyone actually running this product, but the product's near-zero production footprint caps aggregate real-world risk. The chief unresolved conflict is impact magnitude (provider Low vs. RCE-class expectation) and whether the save endpoint is truly pre-auth as the CVSS PR:N and tracexlabs claim imply - verify against source.

A remote attacker sends a crafted multipart POST to /classes/Users.php?f=save, abusing the img/id parameter so move_uploaded_file writes a PHP file into a web-accessible directory with no extension or content validation. The attacker then requests the uploaded file to execute arbitrary code (webshell) on the server. Public exploit code is available and a referenced write-up describes this as pre-authentication RCE.