CVE-2026-10806

Vulnerability

A vulnerability exists in the file attachment upload functionality within application/PHP/objects/updates/add_post.php in mjperpinosa stumasy. The issue stems from an insufficient validation of uploaded files, where the check relies on a logical OR condition for MIME types and file extensions. This allows an attacker to bypass security checks by providing a malicious PHP file with a forged MIME type (e.g., application/pdf) while retaining a .php extension.

Exploitation

An attacker can initiate this attack remotely by crafting a multipart POST request to add_post.php. They need to set the file field to a malicious PHP web shell, forge the Content-Type header to a whitelisted MIME type like application/pdf, and ensure the filename ends with .php. The server will then move the file to a web-accessible directory, such as ../../../../documents/files/, using the provided filename.

Impact

Upon successful exploitation, an attacker can achieve Remote Code Execution (RCE) on the server. By accessing the uploaded PHP file directly via its URL (e.g., http://target.com/documents/files/shell.php), the attacker's code will be executed with the privileges of the web server process.

Mitigation

This product uses a rolling release model, and specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report [1], but as of the available references, no patch or specific mitigation details have been publicly disclosed by the developers. The project has not responded to the issue report [1, 2].