Cak Filemanagement System CVE-2026-119620

The specific prerequisite is reaching the file-upload handling in admin/add_logs.php, where the 'File' argument is passed to move_uploaded_file without adequate type/extension restriction (CWE-434), allowing an attacker-controlled file to be written to the server. The CVSS vector states no authentication or user interaction is required (PR:N/UI:N), but the endpoint's admin/ path strongly suggests it is intended as an administrative function, so whether access control is actually enforced is not confirmed in the available sources and would materially limit exploitation if present. Realistic impact also depends on the upload directory being web-accessible and permitting script execution.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw with no stated privilege or interaction requirement, but all three impact metrics are rated Low (VC:L/VI:L/VA:L), yielding a moderate 6.9 base score - a notably conservative impact rating for an unrestricted file upload (CWE-434), which in practice often enables webshell deployment and full server compromise. Exploitation maturity is E:P (proof-of-concept), consistent with the input showing a reference-only PoC that is not verified as working exploit code; there is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', indicating a routine-priority patch cadence rather than emergency. Two signals conflict and should be verified: the affected code sits at admin/add_logs.php, implying an administrative endpoint that would normally require authentication, yet the CVSS vector asserts PR:N (unauthenticated) - this discrepancy should be confirmed with the project. This is a single-source (VulDB) report against an obscure GitHub project, so treat it as a low-to-moderate real-world priority pending independent confirmation.

A remote attacker reaches the admin/add_logs.php endpoint and submits a request manipulating the 'File' parameter so that move_uploaded_file stores an attacker-controlled file (e.g. a PHP script) without restriction, which can then be requested to run server-side code. A public PoC reference exists (the project's GitHub issue), but it is not verified as working exploit code, and whether the endpoint enforces admin authentication is not confirmed in the available data.