CVE-2026-73328: Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/

Published Nov 3, 2026

Updated

Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must be authenticated. They can then submit a base64-encoded PHP payload and a filename ending in .php to the /upload/send/ endpoint.

What access could successful exploitation provide?

The uploaded PHP file can be placed in the web root and invoked through an HTTP request. Its code runs as the web server user, allowing compromise of data and services accessible to that account.

How can I determine whether an instance may be vulnerable?

Instances running Volmarg Personal Management System through version 2.1.0 should be treated as affected. Review uploads handled by /upload/send/ for PHP filenames or unexpected executable files in the web root.

CVE-2026-73328: Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What access could successful exploitation provide?

How can I determine whether an instance may be vulnerable?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What access could successful exploitation provide?

How can I determine whether an instance may be vulnerable?