PHP Travel Agency System EUVD-2026-111113

The concrete prerequisite is reaching the admin/employee_insert.php employee-creation function and supplying the 'employee photo' upload field, which per the description accepts a file without restriction (CWE-434). Full server compromise additionally requires that the uploaded file land in a web-accessible, script-executable directory - this is not confirmed in the sources. The principal limiting factor is that this is an administrative endpoint: exploitation presupposes access to the admin employee-insert function, and whether that function requires authentication is not stated in the available data, so the input's PR:N (unauthenticated) assumption cannot be confirmed. No user interaction is indicated.

Signals are mixed and point to a lower real-world priority than CWE-434 alone might suggest. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VC:L/VI:L/VA:L yields only a 5.5 (medium) base score, and the vuln.today decision label is 'this_month' rather than act_now or emergency. There is no CISA KEV listing and no EPSS figure in the input, so widespread or automated exploitation is not evidenced. A PoC reference exists (the GitHub issue report) but it is a report, not verified working exploit code. The most important conflict: the affected code lives in admin/employee_insert.php - an administrative function - yet the input vector asserts PR:N (unauthenticated); the sources do not state whether the admin area enforces access control, so the true privilege requirement is unverified. If admin authentication is enforced, real risk is materially lower than the PR:N vector implies; if the project ships broken access control (common in this class of PHP project), an unrestricted upload could enable server-side code execution despite the vendor's low impact rating. Treat the exploitability and privilege assumptions as unconfirmed until the vendor or code is checked.

An attacker reaches the admin employee-creation function and submits the employee photo field with a malicious file (e.g. a PHP script) that is stored without type restriction; if the upload directory is web-accessible and executable, the attacker then requests the file to run code on the server. A public PoC reference exists (an upstream GitHub issue), but it is not verified as working exploit code, and whether the endpoint requires admin authentication is not established by the sources.