CVE-2025-70457
CriticalSummary
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 in gallery/upload.php. The application fails to validate file contents and preserves user-supplied extensions, allowing unauthenticated attackers to upload arbitrary PHP code by spoofing MIME type, leading to full system compromise.
Risk Assessment
An attacker can gain full control of the server, potentially leading to data theft, content modification, or further attacks.
Recommendation
Implement proper file content validation (e.g., magic bytes) and enforce safe file extensions; consider removing or securing the upload.php script.
Original NVD description (English source)
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file contents. Additionally, the application preserves the user-supplied file extension during the save process. This allows an unauthenticated attacker to upload arbitrary PHP code by spoofing the MIME type as an image, leading to full system compromise.