CVE-2026-119620
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability was found in cak-filemanagement-system in the move_uploaded_file function of admin/add_logs.php. Manipulating the File argument allows unrestricted file upload, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker could upload arbitrary files, including executable ones, potentially leading to remote code execution and system compromise. The public exploit increases the risk of rapid exploitation.
Recommendation
Update the system to a patched version as soon as possible or restrict access to admin/add_logs.php. In the meantime, enforce file type validation and monitor for unusual uploaded files.
Other vulnerabilities in cak-filemanagement-system
Original NVD description (English source)
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS