College-Notes-Gallery CVE-2026-95820

Requires an authenticated session on the College-Notes-Gallery application (CVSS PR:L) with access to the admin-oriented endpoint /dashboard/userprofile.php?section=admin1; the attack manipulates the 'image' upload argument, which performs no/insufficient file-type restriction (CWE-434). Exploitation is remote over the network (AV:N) with low complexity and no user interaction. Limiting factors: valid credentials are needed, the target is an obscure rolling-release project with a tiny install base, and no official fix is available (vendor unresponsive), so defenders must apply upload validation or access controls manually.

Signals are mixed but point to a LOW real-world priority. The CVSS 4.0 base score is 5.3 (MEDIUM) with AV:N/AC:L/AT:N/PR:L/UI:N and only partial VC:L/VI:L/VA:L impacts, and the vector carries E:P (Proof-of-Concept), consistent with the input flag that public exploit code exists via a GitHub issue. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation - the correct characterization is 'publicly available exploit code exists' rather than active exploitation. The vendor's L/L/L impact rating is conservative for an unrestricted-upload flaw: CWE-434 in an admin dashboard endpoint (/dashboard/userprofile.php?section=admin1) that accepts an attacker-controlled 'image' argument realistically enables a PHP webshell and therefore code execution (C:H/I:H/A:H), which is why my independent assessment is higher than the vendor's. The offsetting factor is PR:L - the CVSS vector requires authentication, so this is not an unauthenticated internet-wide risk. Net: a genuine but low-priority issue, capped by required authentication, a tiny deployment footprint, and no signal of exploitation beyond a published PoC. Note: this is a VulDB-brokered disclosure against a rolling-release project with no vendor response and no affected/fixed version data, limiting verification.

An authenticated user of a College-Notes-Gallery deployment (PR:L) sends a crafted request to /dashboard/userprofile.php?section=admin1 manipulating the 'image' parameter to upload a file whose type is not restricted, planting a PHP webshell in a web-accessible path. The attacker then requests the uploaded script to execute arbitrary commands on the server. Public exploit code referenced from a GitHub issue lowers the effort required.