Personal Management System CVE-2026-73328

Requires an authenticated session with sufficient privilege (CVSS PR:H) to reach the /upload/send/ endpoint; the attacker submits a request with a base64-encoded fileContent and a fileName ending in .php. Exploitation depends on the upload being written into the web root and the server executing PHP from that directory, which is the described default behavior of the upload handling in FileUploadValidator/FileUploadConfigurator through v2.1.0. The primary limiting factor is the authentication/privilege requirement - this is not exploitable by an unauthenticated attacker - so realistic risk is highest where credentials are weak, shared, or where the instance is exposed to multiple or untrusted users.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H) scores 8.6 (High) and describes a remotely reachable but authentication-gated flaw: PR:H confirms the attacker must already hold a privileged/authenticated session, which meaningfully lowers real-world exposure versus an unauthenticated RCE. No EPSS probability, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no signal of active or widespread exploitation; the only priority signal is the vuln.today 'this_week' decision label, consistent with a serious-but-not-emergency issue. The impact ceiling is high (full code execution as the web server user, hence VC/VI/VA:H), but because this is an open-source self-hosted personal application and exploitation requires valid credentials, this reads as a genuine high-severity bug of limited blast radius rather than a mass-exploitation threat. Note the signals are internally consistent - high technical impact tempered by a privilege requirement - and no CVSS 3.1 vector was supplied in the input, only the 4.0 vector.

An attacker who already has authenticated access to the Personal Management System (via legitimate credentials, credential theft, or a shared/single-user deployment exposed to others) sends a crafted request to /upload/send/ containing base64-encoded PHP in fileContent and a .php fileName. The file is written into the web root with no extension or content validation, and the attacker then requests the file's URL to execute arbitrary PHP as the web server user. No public exploit was identified at time of analysis, though VulnCheck's advisory and GitHub issue #167 reference the exact vulnerable source code.