Live › vulnerability › CVE-2026-73328
Volmarg Personal Management System through 2.1.0 lets any authenticated user upload PHP files through the /upload/send/ endpoint. An attacker can then request the uploaded file to run code as the web server user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Anyone self-hosting Volmarg Personal Management System (personal-management-system) 2.1.0 or earlier. An attacker needs a logged-in account, then can upload a .php file through /upload/send/ and request it to run code as the web server user. Single-user instances not exposed to the internet carry the least risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| personal-management-system | composer | <= 2.1.0 | – |
v2.1.0 (27 Sep) is the latest on the project's releases pageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
This page as .md · .json · in your agent: get_signal("CVE-2026-73328")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.