CVE-2026-73328
HighCVSS 7.2Summary
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
Risk Assessment
An authenticated attacker can achieve remote code execution on the web server, leading to full compromise of the application and potentially the host. This may result in data leakage and further lateral movement.
Recommendation
Update Volmarg Personal Management System to a patched version and restrict the ability to upload executable files. Additionally, review user permissions and monitor for unusual files in the web root.
Other vulnerabilities in Volmarg Personal Management System
See all- CVE-2026-118755High
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
- CVE-2026-40526Medium
Volmarg Personal Management System has a path traversal vulnerability allowing authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling access to sensitive files accessible to the PHP-FPM worker.
Original NVD description (English source)
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS