Online Exam LMS CVE-2026-14776

Exploitation requires a valid authenticated session with at minimum low-privilege access (PR:L per the CVSS 4.0 vector), such as a registered student, exam taker, or any account the application permits to self-register. The vulnerable endpoint (/upload_files.php) and its file upload feature must be reachable and operational - no non-default configuration is required to trigger the flaw, as the pathinfo() validation bypass is inherent to the default upload handler implementation. Exploitation is bounded by the need for prior authentication: unauthenticated access to the upload endpoint is not confirmed by available data, and the CVSS PR:L metric confirms at least a low-privilege account is required. The application must be deployed on a PHP-enabled web server reachable by the attacker (AV:N confirms network-level access suffices). No specific platform, OS, or feature flag beyond basic PHP operation is required.

The provided CVSS 4.0 score of 2.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) appears significantly understated and conflicts with the exploitation evidence. The network attack vector (AV:N), low complexity (AC:L), and lack of required attack prerequisites (AT:N) confirm this is remotely exploitable with minimal friction once a low-privilege account is obtained. However, the Low impact ratings across VC/VI/VA and the absence of any subsequent-system impact (SC:N/SI:N/SA:N) are inconsistent with CWE-434 in PHP - successful webshell upload in a PHP application realistically yields full server compromise, not low impact. The GitHub exploit is explicitly named 'OE-LMS-RCE-2-upload_files.md', directly asserting remote code execution capability. The E:P modifier confirms publicly available exploit code, which substantially elevates real-world risk beyond what the numeric score suggests. The vulnerability is not in the CISA KEV catalog, so active exploitation has not been formally confirmed, but the combination of a public RCE-labeled PoC and a trivially exploitable CWE-434 in an internet-deployable PHP application warrants treating this as materially higher risk than the 2.1 score indicates. The low footprint of SourceCodester applications in enterprise environments limits aggregate exposure.

An attacker registers or acquires a low-privilege authenticated account on the target application (e.g., as a student or exam participant), then submits a crafted HTTP POST request to /upload_files.php containing a PHP webshell whose filename is constructed to evade the pathinfo()-based extension check - for example, by exploiting which pathinfo() component the validator evaluates. Once the file is stored on the server in a web-accessible directory, the attacker navigates to its URL to trigger execution, obtaining arbitrary OS command execution at the privilege level of the web server process. A public proof-of-concept documenting this exact remote code execution path is available at the GitHub reference linked in the VulDB advisory.