CVE-2026-18927: imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload
A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulation of the argument choosefile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18927?
The severity of CVE-2026-18927 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-18927?
To fix CVE-2026-18927, implement proper validation and restrictions for file uploads in the storeProfileImage function.
What type of vulnerability is CVE-2026-18927?
CVE-2026-18927 is classified as a Malicious File Upload vulnerability.
What component is affected by CVE-2026-18927?
CVE-2026-18927 affects the Shared Upload Helper component in the student_profile_pic.php file.
What could an attacker achieve through CVE-2026-18927?
An attacker could exploit CVE-2026-18927 to upload and execute malicious files on the server.