SourceCodester LMS CVE-2026-108975

Exploitation requires network reachability to the admin/add_admin.php endpoint of SourceCodester Library Management System 1.0 and the ability to submit the 'image' upload parameter, which move_uploaded_file writes to disk without file-type/extension validation; successful RCE additionally requires that the upload destination be web-accessible and that the server execute PHP from it. The CVSS vector asserts PR:N (unauthenticated) and the public exploit is titled 'pre-auth RCE', but the endpoint resides under an 'admin/' path - if the deployment enforces authentication or access control on the admin directory, exploitation would be limited to authenticated/admin users; this authentication requirement is not confirmed from the available data and should be verified against the actual installation.

Signals conflict and must be weighed carefully. The vendor (VulDB) CVSS 4.0 vector scores this 5.5 (medium) with AV:N/AC:L/PR:N/UI:N and only Low impacts across VC/VI/VA, and E:P (proof-of-concept exploit maturity). However, the vulnerability class - CWE-434 unrestricted file upload via move_uploaded_file in a PHP application - typically yields webshell deployment and full remote code execution, which is inconsistent with the all-Low impact rating; the public exploit reference is explicitly titled 'lms-preauth-rce' (pre-authentication RCE), strongly implying High integrity/availability/confidentiality impact rather than Low. This under-scoring of impact should be treated with suspicion and verified. KEV status is NO and no EPSS score is provided, so there is no evidence of widespread or automated real-world exploitation; a public exploit exists (POC=YES) but POC availability is not the same as active exploitation. The affected product, SourceCodester Library Management System 1.0, is a small hobby/educational PHP application with negligible production footprint, which substantially lowers real-world priority despite the dangerous vulnerability class. Net: this is a genuinely dangerous bug class with a public exploit, but low real-world prevalence and no KEV/EPSS corroboration make it a low-to-moderate operational priority for most defenders - except anyone actually running this specific application exposed to a network.

A remote attacker reaches the admin/add_admin.php endpoint and submits the 'image' parameter with a malicious PHP file instead of a legitimate image, which move_uploaded_file stores in a web-accessible directory without validation. The attacker then requests the uploaded file to execute arbitrary PHP code (a webshell) on the server. Public exploit code is available and is described by its publisher as achieving pre-authentication remote code execution.