Is there a public PoC exploit available for CVE-2026-7071?

Yes, a public proof-of-concept exploit is available for CVE-2026-7071. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Online Job Portal CVE-2026-7071

Q: What is the CVSS score of CVE-2026-7071?

CVE-2026-7071 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25747 MEDIUM

Insertion of Sensitive Information into Externally-Accessible File (CWE-538)

2026-04-27 VulDB

Information Disclosure Online Job Portal

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 27, 2026 - 18:39 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 01:29 vuln.today

CVSS changed

Apr 27, 2026 - 01:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 01:15 euvd

EUVD-2026-25747

Analysis Generated

Apr 27, 2026 - 01:15 vuln.today

CVE Published

Apr 27, 2026 - 00:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/user-cvs/. The manipulation leads to file and directory information exposure. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

CodeAstro Online Job Portal 1.0 exposes file and directory information through the /users/user-cvs/ endpoint via remote unauthenticated access, allowing attackers to enumerate and retrieve sensitive resume and user data. The vulnerability has publicly available exploit code and affects all versions of the application via the CPE cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*. CVSS 5.5 with confirmed public exploit availability and EPSS exploitation probability indicates moderate real-world risk for deployments accessible over the network.

Technical ContextAI

CodeAstro Online Job Portal is a web-based job portal application written using a web framework exposing user-submitted resume files through a directory listing vulnerability. The /users/user-cvs/ endpoint fails to implement proper access controls and directory indexing restrictions, allowing remote attackers to enumerate and access stored curriculum vitae (CV) files without authentication. The root cause is CWE-538 (Information Exposure Through Publicly Accessible File), a file system misconfiguration that exposes sensitive application data. The CPE indicates all versions of the CodeAstro Online Job Portal are affected through the wildcard version pattern, suggesting the vulnerability exists in the baseline design rather than a specific version.

RemediationAI

The primary remediation is to implement proper access controls on the /users/user-cvs/ directory immediately by restricting HTTP requests to authenticated users only, removing directory listing capabilities, and requiring valid session tokens for CV retrieval. If available from CodeAstro, upgrade to a patched version once released; check https://codeastro.com/ for security advisories. As an interim compensating control, deploy a Web Application Firewall (WAF) rule to block or require authentication for requests to /users/user-cvs/ and similar sensitive paths, with side effect of requiring rule maintenance across application updates. Alternatively, restrict network access to the CodeAstro portal to trusted IP ranges or require VPN access; this prevents remote exploitation but impacts legitimate public-facing portals. Migrate any exposed resume files from the web-accessible /users/user-cvs/ directory to a protected location outside the web root and implement access logging to identify which CVs were exposed. Review stored resumes for PII and notify affected job applicants per applicable data protection regulations.