Live › vulnerability › CVE-2026-119620
A file upload handler in admin/add_logs.php of the cak-filemanagement-system project accepts a manipulated File argument without restriction. A remote attacker can upload arbitrary files, and the exploit has been publicly disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Deployments of the cak-filemanagement-system project up to commit 5e6433246475e66462e1fea980688de96a049297 that expose the admin/add_logs.php upload function to remote users are affected. The sources do not say whether the admin area requires authentication. The project has not responded to the early issue report, so no fix is stated.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cak-filemanagement-system | other | <= 5e6433246475e66462e1fea980688de96a049297 | – |
admin/add_logs.php from the cak-filemanagement-system project5e6433246475e66462e1fea980688de96a049297No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-119620")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.