Which versions of PHP are affected by CVE-2026-4875?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4875, a unrestricted file upload vulnerability rated CVSS 5.1. This could allow unauthorized file access.

Is there a public PoC exploit available for CVE-2026-4875?

Yes, a public proof-of-concept exploit is available for CVE-2026-4875. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4875?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

PHP CVE-2026-4875

Q: What is the CVSS score of CVE-2026-4875?

CVE-2026-4875 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16169 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-26 VulDB

PHP File Upload Free Hotel Reservation System Itsourcecode

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 12:45 euvd

EUVD-2026-16169

Analysis Generated

Mar 26, 2026 - 12:45 vuln.today

CVE Published

Mar 26, 2026 - 12:23 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /admin/mod_amenities/index.php?view=add. This manipulation of the argument image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Free Hotel Reservation System 1.0 permits unrestricted file uploads via the image parameter in the /admin/mod_amenities/index.php?view=add endpoint, allowing remote attackers with high privileges to upload arbitrary files. The vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects the amenities management module and has publicly available exploit code. With a CVSS v4.0 score of 5.1 and network-accessible attack vector requiring high administrative privileges, this poses a moderate risk primarily to authenticated administrators or systems where authentication has been compromised.

Technical ContextAI

The vulnerability resides in the PHP-based hotel reservation application (cpe:2.3:a:itsourcecode:free_hotel_reservation_system:*:*:*:*:*:*:*:*) within the administrative interface file /admin/mod_amenities/index.php. The root cause is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating insufficient validation of uploaded file types and content. The 'image' parameter accepts file submissions without proper extension whitelisting, MIME type verification, or content inspection before storage. This classic web application flaw allows attackers to bypass client-side or weak server-side validation controls, potentially enabling storage of executable files (.php, .exe, etc.) within the web-accessible directory structure.

RemediationAI

Upgrade Free Hotel Reservation System to a patched version released by itsourcecode (exact patched version not specified in available advisories; consult vendor directly or check https://itsourcecode.com/ for release notes). Until patching is possible, implement strict file upload controls: enforce server-side whitelist validation limited to safe image types (JPEG, PNG, WebP), verify MIME types independently of file extensions, store uploaded files outside the web root or in a non-executable directory (configure via .htaccess or server directives to disable PHP execution), and restrict file upload access to strictly necessary high-privilege accounts with additional role-based controls. Implement file size limits and consider virus scanning on uploads.