CVE-2026-10807

Vulnerability

The mjperpinosa stumasy application contains a vulnerability in application/PHP/objects/profiles/change_profile_image.php that allows for unrestricted file uploads. The script attempts to validate uploaded files by checking if the client-supplied MIME type or file extension is in a whitelist using an OR condition. This allows an attacker to bypass validation by providing a whitelisted MIME type (e.g., image/png) while using a malicious file extension (e.g., .php). The affected product operates on a rolling release basis, so specific version details are not available.

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The attack involves sending a multipart POST request to change_profile_image.php with the file field pr_profile_image. The attacker must forge the Content-Type header to a whitelisted MIME type, such as image/png, while uploading a file with a .php extension (e.g., avatar.php). The server will save the file with a randomized name but retain the .php extension, making it executable.

Impact

Successful exploitation of this vulnerability leads to remote code execution (RCE) on the server. The server responds with the generated filename, allowing the attacker to immediately access and execute the uploaded PHP script. This grants the attacker the privileges of the web server process.

Mitigation

This product operates on a rolling release basis, and specific version details for affected or updated releases are not provided. The project was informed of the issue early but has not yet responded. No patched version or workaround is currently available in the provided references. The project was informed of the problem early through an issue report but has not responded yet [1].