---
id: "CVE-2026-117512"
kind: "vulnerability"
aliases: ["CVE-2026-117512"]
title: "php-travel-agency-system: employee photo upload accepts unrestricted files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "php-travel-agency-system", "fixed": [], "affected": "unknown (no version range published)", "ecosystem": "github"}]
ecosystems: []
tags: ["file-upload", "package", "php", "rce", "self-hosted"]
not_affected_if: ["admin-path-blocked", "not-using-project"]
published_at: "2026-10-27T17:16:59+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:39:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117512", "first_seen_at": "2026-10-27T17:32:46+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:39:22+00:00"}]
---

# php-travel-agency-system: employee photo upload accepts unrestricted files

The admin employee insert page in oretnom23's php-travel-agency-system accepts an employee photo upload without restricting the file type. A remote attacker can upload arbitrary files, which can lead to running code on the server if the uploaded file is executed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:php-travel-agency-system affected unknown (no version range published) fixed ?

## How to check

- Check whether admin/employee_insert.php exists in the deployed project and whether it saves the photo upload without checking extension or content type
- Look in the upload directory for .php/.phtml or other unexpected files
- No version range is published; treat every copy of oretnom23/php-travel-agency-system as affected

## Fix

No fix: the project has not responded. Workaround: remove or block admin/employee_insert.php, or add server-side checks for extension and MIME type and store uploads outside the web root with PHP execution disabled.

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117512
- 2026-10-27T17:39:22+00:00 analyst — VulDB VDB-427078 (CNA) confirms: no vendor response, public exploit claimed, no version range or fix given. Same employee_insert.php upload flaw was reported in 2024 for the SourceCodester Online Travel Agency System 1.0 (CVE-2023-31941), where the PoC shows the admin form; whether login is needed here is unconfirmed. No PoC link for this CVE itself. Nothing verified.

## Documents

- [advisory] VDB-427078 php-travel-agency-system employee_insert.php unrestricted upload https://vuldb.com/vuln/427078
- [mentions] Online Travel Agency System employee_insert.php file upload report (sibling CVE-2023-31941, same code lineage) https://github.com/DiliLearngent/BugReport/blob/main/php/Online-Travel-Agency-System/bug1-File%20upload.md

## From the sources

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_