CVE-2026-107356: Malicious File Upload

Published Nov 10, 2026

Updated

U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.

Affected Software

1 affected component

U.S. Geological Survey Area Species Management Research Program (ARMI)

Event History

Nov 10, 2026

CVE Published

via NVD·10:18 PM

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to upload a crafted PHP file. No user interaction is required.

What access could successful exploitation provide?

The uploaded PHP file can be accessed to execute commands and return command output from the server. The vulnerability affects confidentiality, integrity, and availability of the vulnerable system.

How can I determine whether an instance may have been exploited?

Review the /uploads/ directory for unexpected PHP files and investigate requests accessing uploaded PHP content. Also review authenticated upload activity for suspicious or unexplained file submissions.

What should be done if patching cannot be completed immediately?

Restrict authenticated upload access, block PHP execution within the /uploads/ directory, and remove or quarantine unexpected uploaded PHP files. Monitor upload and web-access logs for attempts to upload or invoke PHP files.

When was a fix made available?

The issue was fixed on 2026-07-20.

CVE-2026-107356: Malicious File Upload

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could successful exploitation provide?

How can I determine whether an instance may have been exploited?

What should be done if patching cannot be completed immediately?

When was a fix made available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could successful exploitation provide?

How can I determine whether an instance may have been exploited?

What should be done if patching cannot be completed immediately?

When was a fix made available?