CVE-2026-102842: gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulation of the argument ADMINRSKCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates low privileges are required. Exploitation involves manipulating the ADMIN_RS_KCFINDER argument used by the cekUserLogin function.
Are fixed versions available?
No affected or updated release versions are provided because the project uses rolling releases. The described affected code state is up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.
How urgent is remediation?
Public exploit availability is reported, so systems exposing the affected KCFinder File Manager component should be prioritized. The issue can result in unrestricted file upload, with low confidentiality, integrity, and availability impacts reflected in the supplied severity data.
Has the project acknowledged or addressed the report?
The project was notified early through an issue report, but no response has been reported.