Which versions of PHP are affected by CVE-2026-6602?

rickxy Hospital Management System contains an unauthenticated file upload vulnerability (CVE-2026-6602) that allows attackers to upload malicious files and execute code on hospital infrastructure.

Is there a public PoC exploit available for CVE-2026-6602?

Yes, a public proof-of-concept exploit is available for CVE-2026-6602. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6602?

Within 24 hours: Isolate or restrict network access to rickxy Hospital Management System, particularly the /backend/admin/his_admin_account.php endpoint; review access logs for suspicious file uploads. Within 7 days: Deploy a Web Application Firewall (WAF) rule to block POST requests to the vulnerable endpoint; contact rickxy vendor regarding patch timeline and rolling release versioning; inventory all instances and document versions currently deployed. Within 30 days: Evaluate replacement solutions with active security maintenance; implement compensating controls (input validation, file type restrictions at OS level); conduct forensic analysis of logs for signs of exploitation.

PHP CVE-2026-6602

Q: What is the CVSS score of CVE-2026-6602?

CVE-2026-6602 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23768 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-20 VulDB

PHP File Upload

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 20, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

Apr 20, 2026 - 04:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23768

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /backend/admin/his_admin_account.php. The manipulation of the argument ad_dpic results in unrestricted upload. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.

AnalysisAI

Unrestricted file upload in rickxy Hospital Management System allows remote unauthenticated attackers to upload malicious files via the /backend/admin/his_admin_account.php endpoint, leading to potential remote code execution, data exfiltration, or system compromise. Public exploit code exists (GitHub), significantly lowering exploitation barrier. The product uses rolling releases with no fixed versioning, complicating patch tracking. CVSS 7.3 with EPSS not provided, but publicly available POC elevates real-world risk.

Technical ContextAI

This is a CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerability in a PHP-based hospital management system. The affected endpoint /backend/admin/his_admin_account.php accepts file uploads via the 'ad_dpic' parameter without proper validation of file type, extension, or content. In PHP applications, unrestricted upload commonly enables attackers to upload web shells (PHP scripts) that execute arbitrary commands when accessed via HTTP. The backend admin path suggests this may be intended for profile picture uploads, but lacks server-side controls to restrict uploads to safe image formats only. The CPE identifies rickxy Hospital Management System as the affected product, with vulnerability present in commits up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4.

RemediationAI

Update to the latest commit from the rickxy Hospital Management System repository (https://github.com/rickxy/Hospital-Management-System) that addresses this vulnerability, verifying the commit is newer than 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Since no formal patch advisory exists and the project uses rolling releases, review recent commits for file upload validation fixes in /backend/admin/his_admin_account.php. If immediate patching is not feasible, implement these compensating controls with specific trade-offs: (1) Restrict access to /backend/admin/* paths to authenticated admin users only via web server configuration (Apache .htaccess or nginx location blocks) - this mitigates unauthenticated exploitation but breaks legitimate unauthenticated admin access if design requires it, (2) Implement web application firewall (WAF) rules to block POST requests to his_admin_account.php containing executable file extensions (.php, .phtml, .php5, .phar) in ad_dpic parameter - may cause false positives if legitimate filenames contain these strings, (3) Configure PHP disable_functions directive to block shell execution functions (system, exec, shell_exec, passthru) - reduces RCE impact but may break legitimate application functionality that relies on system commands, (4) Deploy the application in a containerized environment with read-only filesystem for web root - prevents uploaded files from being written but requires architectural changes. Verify fixes by testing upload attempts with .php files to confirm rejection.