What is the CVSS score of CVE-2026-38751?

CVE-2026-38751 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenSTAManager are affected by CVE-2026-38751?

CVE-2026-38751 affects OpenSTAManager 2.10 and earlier, allowing high-privilege authenticated users to upload malicious files through the module update function, resulting in remote code execution.

Is there a public PoC exploit available for CVE-2026-38751?

Yes, a public proof-of-concept exploit is available for CVE-2026-38751. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-38751?

Within 24 hours: Inventory all OpenSTAManager deployments and document version numbers; restrict administrative access to module update functionality via network or application controls. Within 7 days: Implement additional logging and alerting on modules/aggiornamenti/upload_modules.php file uploads; review administrative account activity logs for suspicious uploads. Within 30 days: Contact OpenSTAManager vendor for patch availability; evaluate upgrading to a patched version when released, or assess migration to alternative ERP solutions.

OpenSTAManager CVE-2026-38751

EUVD-2026-27086 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-04 mitre

GHSA-rm34-fg4m-39mw

PHP File Upload

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 14:22 vuln.today

CVSS changed

May 05, 2026 - 14:22 NVD

7.2 (HIGH)

DescriptionCVE.org

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)

AnalysisAI

Arbitrary file upload in OpenSTAManager 2.10 and earlier allows authenticated high-privilege users to upload malicious files via the module update functionality at modules/aggiornamenti/upload_modules.php, leading to remote code execution. Publicly available exploit code exists (GitHub POC), though EPSS exploitation probability remains low (2%, 5th percentile), suggesting limited observed exploitation activity. CVSS 7.2 reflects high impact but requires high-privilege authentication (PR:H), substantially limiting attack surface to compromised admin accounts or malicious insiders.

Technical ContextAI

OpenSTAManager is a PHP-based open-source management software for Italian businesses. The vulnerability exists in the module update mechanism (modules/aggiornamenti/upload_modules.php), which fails to properly validate file types or contents during upload operations. This represents CWE-434 (Unrestricted Upload of File with Dangerous Type), a common weakness in PHP applications where user-supplied files are accepted without sufficient sanitization of file extensions, MIME types, or content validation. The upload endpoint processes module update packages but lacks adequate controls to prevent execution of uploaded PHP scripts or other dangerous file types, allowing an authenticated administrator to inject webshells or malicious code into the application directory structure.

RemediationAI

Upgrade to OpenSTAManager version 2.10.1 or later if available, verifying the fix through the official GitHub repository at https://github.com/devcode-it/openstamanager. No vendor security advisory or specific patch version is confirmed in available data sources; organizations should monitor the GitHub repository releases and commit history for security fixes addressing CVE-2026-38751. Until patching, implement compensating controls: (1) Restrict access to modules/aggiornamenti/upload_modules.php to only essential administrator accounts via web server access control rules (e.g., Apache .htaccess IP whitelisting or nginx location blocks) - trade-off: breaks module update functionality for restricted admins. (2) Implement file upload validation at web server level using ModSecurity rules to block executable extensions (.php, .phtml, .php5) in upload directories - trade-off: may require whitelist maintenance for legitimate module updates. (3) Enable PHP disable_functions directive to restrict dangerous functions (exec, shell_exec, system, passthru) - trade-off: may impact legitimate application functionality. (4) Monitor admin account activity and file system changes in the modules directory. Advisory reference: https://vuldb.com/vuln/361013.