What is the CVSS score of CVE-2026-36387?

CVE-2026-36387 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

CODEASTRO Membership Management System CVE-2026-36387

EUVD-2026-28391 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-07 mitre

GHSA-rj73-qp5q-ppqx

PHP RCE File Upload N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 18:01 vuln.today

CVSS changed

May 07, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

May 07, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. This vulnerability affects the file upload functionality, where improper file sanitization allows attackers to inject malicious files which leads RCE.

AnalysisAI

Remote code execution in CODEASTRO Membership Management System v1.0 allows unauthenticated attackers to upload and execute arbitrary files via the /add_members.php endpoint due to improper file sanitization. The vulnerability enables confidentiality and integrity compromise with CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating network-accessible exploitation with no authentication or user interaction required. Public exploit code is available on GitHub.

Technical ContextAI

The vulnerability resides in the file upload functionality of /add_members.php, a PHP-based endpoint within the membership management system. CWE-434 (Unrestricted Upload of File with Dangerous Type) indicates the root cause: the application fails to properly validate, sanitize, or restrict uploaded file types before storing them in a web-accessible location. Attackers can bypass file type checks (likely examining only MIME type or file extension) and upload executable files such as PHP shells, JSP files, or other server-side scripts. When these uploaded files are accessed via HTTP, the web server executes them with the privileges of the PHP/web process, achieving arbitrary code execution.

RemediationAI

Immediate action: if CODEASTRO Membership Management System v1.0 is deployed, disable the /add_members.php endpoint or restrict access via web server configuration (e.g., deny all requests to this path) until a patched version is available. Contact CODEASTRO (codeastro.com) directly to inquire about a security patch addressing file upload validation. If a patched version is released, upgrade to it immediately. If no patch is forthcoming, implement the following compensating controls: (1) Restrict file uploads to a non-web-accessible directory outside the document root, eliminating the ability to execute uploaded files via HTTP; (2) Implement strict server-side file type validation using magic number inspection (not just MIME type or extension), allowing only expected file types (e.g., PDF, image formats if the use case permits); (3) Disable script execution in the upload directory via web server configuration (e.g., Apache .htaccess: deny script execution; nginx: disable PHP handler for the upload directory); (4) Generate randomized filenames for uploaded files and remove file extensions, preventing direct execution. Each control adds deployment complexity-consult with your infrastructure team on compatibility.