Online Job Portal CVE-2026-77681

Exploitation requires a valid authenticated user account on the CodeAstro Online Job Portal instance (PR:L per the provided CVSS 4.0 vector), meaning self-registration must be enabled or the attacker must obtain credentials through other means. The vulnerable endpoint is /users/update-profile.php, specifically the Name argument in the file upload flow. For the most severe outcome (remote code execution via webshell), the web server must permit PHP script execution within the upload destination directory - if uploads are stored outside the webroot or execution is disabled there, impact degrades to arbitrary file storage. Exploitation is limited to instances of version 1.0 and is network-accessible without requiring physical or local access. No special non-default configuration has been identified as a prerequisite beyond possessing a valid user account.

Multiple signals present a conflicting picture. The CWE-434 classification in a PHP application is inherently high-severity - unrestricted file upload in PHP contexts routinely enables webshell deployment and full server compromise. However, the officially reported CVSS 4.0 score of 2.1 with impact metrics set to VC:L/VI:L/VA:L suggests the scoring authority assessed only limited impact, possibly because the upload directory lacks PHP execution permissions or the application sandboxes uploaded content. This discrepancy should be treated as a data gap rather than a confirmation of low risk. No EPSS score was included in the provided data, and the vulnerability is NOT in CISA KEV. A public POC exists (GitHub issues reference), which elevates practical risk above 'theoretical'. Exploitation requires authentication (PR:L per the CVSS 4.0 vector), which is a meaningful limiting factor. Given CodeAstro's status as an educational/demo product with low enterprise deployment, organizational exposure is expected to be low. Security teams running this product should verify whether /uploads or equivalent directories permit PHP execution before treating the official low score as definitive.

An attacker registers or obtains credentials for a user account on the job portal, then navigates to the profile update page and manipulates the Name argument in the file upload request to bypass extension or MIME type checks, uploading a PHP webshell. If the upload directory permits PHP execution, the attacker directly requests the uploaded file's URL to achieve remote code execution on the web server. A publicly available proof-of-concept hosted at https://github.com/Witiers/CVEs/issues/3 documents the exploitation steps.