HospitalManagement EUVD-2026-89543

Requires low-privilege authenticated access (PR:L) to a deployed gedelumbung HospitalManagement instance and reachability of the KCFinder File Manager upload flow via the ADMIN_RS_KCFINDER argument in the cekUserLogin path. No user interaction (UI:N) and no non-default configuration is called out in the description; the KCFinder file-management component simply must be present and reachable. Limiting factors: valid low-privilege credentials are needed, uploaded files must land in a web-executable location to yield code execution, and the product's overall deployment footprint is small.

Signals conflict on severity. The vendor/VulDB CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields only 5.3 (Medium), rating each impact as Low. However, the CWE-434 unrestricted-upload weakness sits inside the KCFinder File Manager component - a general-purpose file manager where the ability to upload arbitrary files into a PHP application very commonly yields a web shell and full remote code execution, which would justify High impacts rather than Low. VulDB scoring is characteristically conservative, so the 5.3 likely understates real impact. A public exploit exists (referenced GitHub issue #8), raising practical risk, and the exploitation maturity is marked E:P (proof-of-concept). Mitigating factors: this is a niche open-source hospital-management project with a small deployment footprint, the vector requires low-privilege authentication (PR:L), and there is no EPSS score or KEV listing provided. Net: publicly available exploit code exists but there is no evidence of active exploitation; treat as a genuine RCE-class issue on affected instances but scoped by very limited real-world prevalence.

An attacker with low-privilege authenticated access to a HospitalManagement instance manipulates the ADMIN_RS_KCFINDER argument handled by cekUserLogin to reach the KCFinder file-upload path and uploads a malicious PHP file with no type/extension restriction. Because a public exploit is referenced in the project's GitHub issue tracker, the attacker then requests the uploaded file to execute it, obtaining a web shell and code execution on the server.