{"id":"CVE-2026-117512","kind":"vulnerability","aliases":["CVE-2026-117512"],"related":[],"title":"php-travel-agency-system: employee photo upload accepts unrestricted files","description":"A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The admin employee insert page in oretnom23's php-travel-agency-system accepts an employee photo upload without restricting the file type. A remote attacker can upload arbitrary files, which can lead to running code on the server if the uploaded file is executed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"php-travel-agency-system","fixed":[],"affected":"unknown (no version range published)","ecosystem":"github"}],"ecosystems":[],"tags":["file-upload","package","php","rce","self-hosted"],"not_affected_if":["admin-path-blocked","not-using-project"],"how_to_check":"- Check whether admin/employee_insert.php exists in the deployed project and whether it saves the photo upload without checking extension or content type\n- Look in the upload directory for .php/.phtml or other unexpected files\n- No version range is published; treat every copy of oretnom23/php-travel-agency-system as affected","fix":"No fix: the project has not responded. Workaround: remove or block admin/employee_insert.php, or add server-side checks for extension and MIME type and store uploads outside the web root with PHP execution disabled.","status":"open","published_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:36+00:00","updated_at":"2026-10-27T17:39:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T17:34:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"php-travel-agency-system: employee photo upload accepts unrestricted files","impact":"high","summary":"The admin employee insert page in oretnom23's php-travel-agency-system accepts an employee photo upload without restricting the file type. A remote attacker can upload arbitrary files, which can lead to running code on the server if the uploaded file is executed.","category":"package","nicknames":[],"who_cares":["php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker uploads arbitrary files and may run code on the server","analyst_note":"Check the NVD entry and the public exploit for whether admin login is required and which versions are affected; no vendor fix exists per the report.","how_to_check":"- Look for `admin/employee_insert.php` in the deployed project and check whether the photo upload validates file type and extension\n- Confirm whether the installed project is the affected php-travel-agency-system code (unknown version range from sources)","needs_analyst":true,"not_affected_if":["not-using-project"],"who_is_affected":"Sites running oretnom23's php-travel-agency-system with the admin employee insert page reachable. The sources do not say which versions are fixed, and the project has not responded to the report. Teams that do not use this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000577,"input_tokens":3327,"output_tokens":489,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the public exploit for whether admin login is required and which versions are affected; no vendor fix exists per the report.","search":"'-117512':14A,17A '-2026':13A,16A 'accept':9A,45B 'admin':33B 'admin/employee_insert.php':96C 'affect':89C 'agenc':4A,43B,86C 'agency':21A 'arbitrari':60B 'argument':102C 'attack':57B,110C 'carri':115C 'code':67B 'could':125C 'cve':12A,15A 'earli':135C 'employe':6A,34B,47B,103C 'execut':76B 'exploit':119C 'file':11A,24B,53B,61B,74B,95C 'file-upload':23B 'found':80C 'host':31B 'inform':131C 'insert':35B 'issu':138C 'lead':64B 'made':122C 'manipul':99C 'oretnom23':38B,82C 'packag':26B 'page':36B 'part':92C 'perform':97C 'photo':7A,48B,104C 'php':2A,19A,27B,41B,84C 'php-travel-agency-system':1A,18A,40B,83C 'possibl':112C 'problem':134C 'project':129C 'public':123C 'rce':28B 'remot':56B,117C 'report':139C 'respond':143C 'restrict':51B 'result':105C 'run':66B 'self':30B 'self-host':29B 'server':70B 'system':5A,22A,44B,87C 'travel':3A,20A,42B,85C 'type':54B 'unknown':91C 'unrestrict':10A,107C 'upload':8A,25B,49B,59B,73B,108C 'use':127C 'vulner':78C 'without':50B 'yet':144C","nicknames":[],"mitigations":[],"who_affected":"Sites running oretnom23's php-travel-agency-system with the admin employee insert page reachable. The sources do not say which versions are fixed, and the project has not responded to the report. Teams that do not use this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117512","severity":null,"published_at":"2026-10-27T17:16:59+00:00","modified_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117512:904","url":null,"severity":null,"published_at":"2026-10-27T17:39:22+00:00","modified_at":"2026-10-27T17:39:22+00:00","first_seen_at":"2026-10-27T17:39:22+00:00","fetched_at":"2026-10-27T17:39:22+00:00","note":"VulDB VDB-427078 (CNA) confirms: no vendor response, public exploit claimed, no version range or fix given. Same employee_insert.php upload flaw was reported in 2024 for the SourceCodester Online Travel Agency System 1.0 (CVE-2023-31941), where the PoC shows the admin form; whether login is needed here is unconfirmed. No PoC link for this CVE itself. Nothing verified."}],"documents":[{"id":7200,"url":"https://vuldb.com/vuln/427078","title":"VDB-427078 php-travel-agency-system employee_insert.php unrestricted upload","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7201,"url":"https://github.com/DiliLearngent/BugReport/blob/main/php/Online-Travel-Agency-System/bug1-File%20upload.md","title":"Online Travel Agency System employee_insert.php file upload report (sibling CVE-2023-31941, same code lineage)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}