CVE-2026-108973: SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function moveuploadedfile of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability can be exploited remotely and requires no privileges or user interaction. Public exploit information is available, increasing the likelihood of attempted exploitation.
Which component should defenders investigate?
Investigate the user-save endpoint at /classes/Users.php?f=save, specifically its handling of the img and id arguments and calls to move_uploaded_file. The affected product version identified in the available data is SourceCodester Contact Tracing System 1.0.
What security impact can a successful upload have?
The provided severity vector indicates potential low impact to confidentiality, integrity, and availability. The issue is categorized as malicious file upload, but the available data does not specify permitted file types, upload locations, or post-upload execution conditions.