CVE-2026-10172: Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload
A security flaw has been discovered in Bdtask Multi-Store Inventory Management System 1.0. The affected element is the function Upload of the file application/modules/dashboard/controllers/Module.php of the component Component Module. The manipulation of the argument module results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the application endpoint that handles uploads to reduce exposure to remote exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10172?
The severity of CVE-2026-10172 is classified as medium with a CVSS score of 6.3.
What type of vulnerability is identified by CVE-2026-10172?
CVE-2026-10172 is classified as a Malicious File Upload vulnerability.
How do I fix CVE-2026-10172?
To fix CVE-2026-10172, ensure proper validation and restrictions are applied to file uploads in the Bdtask Multi-Store Inventory Management System.
What is affected by CVE-2026-10172?
CVE-2026-10172 affects the upload function in the Module.php file of the Bdtask Multi-Store Inventory Management System.
What can an attacker achieve by exploiting CVE-2026-10172?
An attacker exploiting CVE-2026-10172 can perform unrestricted file uploads that may lead to further compromise of the system.