File Management System EUVD-2026-107363

Exploitation requires reaching the application's file-upload path handled by the save_files function in admin_class.php and supplying a file whose type is not restricted by the application, so success depends on the upload directory being web-accessible and permitting server-side script execution (e.g., PHP). The provided CVSS vector claims no authentication (PR:N) and no user interaction, but the code's location in admin_class.php suggests an administrative context that may require a logged-in session - this should be confirmed. No patched version exists because the project uses rolling releases and has not responded, so all deployments running code at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 are potentially affected.

This is an unrestricted file upload flaw (CWE-434) in the save_files function of admin_class.php in oretnom23's file-management-system-php. The VulDB-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and describes remote, low-complexity, unauthenticated exploitation with LOW impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). Publicly available exploit code exists (POC=YES, via the project's GitHub issue #7), and the embedded SSVC/temporal signal E:P indicates a proof-of-concept rather than functional/weaponized exploitation. The CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, in-the-wild exploitation - the signals point to an available-but-not-widely-exploited issue. The signals partly conflict: unrestricted file upload is classically a high-impact (potential RCE/webshell) issue, yet VulDB rated all impacts only LOW, likely a conservative scoring choice; verify the true impact against the application's upload directory handling. Also note the function resides in 'admin_class.php', which implies an administrative context and possible authentication, yet the vector asserts PR:N - this auth question should be verified with the code/vendor. The vendor has not responded to the issue report, so no patch exists. Net: a real but likely targeted/opportunistic concern against a niche product, not a broad emergency.

A remote attacker locates the file-upload endpoint backed by the save_files function and submits a request with a manipulated 'Upload' argument carrying a malicious file (e.g., a PHP webshell) that the application fails to restrict by type. If the upload lands in a web-accessible, script-executable directory, the attacker then requests the uploaded file to run arbitrary server-side code. Proof-of-concept exploit details have been published in the project's GitHub issue tracker.