Is there a public PoC exploit available for CVE-2026-5472?

Yes, a public proof-of-concept exploit is available for CVE-2026-5472. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-5472

Q: What is the CVSS score of CVE-2026-5472?

CVE-2026-5472 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18803 LOW

Improper Access Control (CWE-284)

2026-04-03 cna@vuldb.com

GHSA-jwr2-2fgr-4g9p

File Upload PHP Authentication Bypass

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 16:22 euvd

EUVD-2026-18803

Analysis Generated

Apr 03, 2026 - 16:22 vuln.today

CVE Published

Apr 03, 2026 - 16:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The affected element is an unknown function of the file /admin_panel/settings.php of the component Profile Picture Handler. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

AnalysisAI

Unrestricted file upload in ProjectsAndPrograms School Management System up to commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59 allows authenticated users to upload arbitrary files via the Profile Picture Handler in /admin_panel/settings.php, enabling remote code execution. The vulnerability affects the File parameter with low attack complexity and has publicly available exploit code; while CVSS 5.3 reflects moderate integrity and confidentiality impact, the low authentication requirement and network accessibility make this a practical privilege escalation and code execution vector for authenticated attackers.

Technical ContextAI

The vulnerability exists in the Profile Picture Handler component of the school management system, specifically in the /admin_panel/settings.php file. The affected technology is a PHP-based web application that processes file uploads for user profile pictures. The root cause (CWE-284 Improper Access Control) indicates insufficient validation of the File parameter, allowing manipulation of the upload mechanism to bypass intended restrictions. The file upload handler fails to enforce proper allowlist validation, file type verification, or storage isolation, enabling attackers to upload executable PHP files or other malicious payloads directly to the web-accessible directory.

RemediationAI

Upgrade to a commit after 6b6fae5426044f89c08d0dd101c7fa71f9042a59 from the official ProjectsAndPrograms repository. Since the project uses continuous delivery with rolling releases, pull the latest version from the main branch or a patched commit specified by the vendor. Implement compensating controls pending upgrade: restrict file upload functionality to authenticated users only (already in place), enforce strict file type validation using allowlist (e.g., accept only image formats: JPEG, PNG), store uploaded files outside the web root or in a non-executable directory, implement file content validation (magic byte checking), and apply web server configuration to prevent PHP execution in upload directories. Review /admin_panel/settings.php for proper input sanitization and access control. References: github-poc at https://github.com/sudo-secure/security-research/blob/main/school-management-system/file-upload-rce/PoC.md and VulDB entries at https://vuldb.com/vuln/355076.