{"id":"CVE-2026-73328","kind":"vulnerability","aliases":["CVE-2026-73328"],"related":[],"title":"Volmarg Personal Management System: file upload lets logged-in users run PHP code","description":"Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.","summary":"Volmarg Personal Management System through 2.1.0 lets any authenticated user upload PHP files through the /upload/send/ endpoint. An attacker can then request the uploaded file to run code as the web server user.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"personal-management-system","fixed":[],"affected":"<= 2.1.0","ecosystem":"composer"}],"ecosystems":[],"tags":["auth-required","package","php","self-hosted","volmarg"],"not_affected_if":["newer-than-2.1.0","unauthenticated-only-access"],"how_to_check":"- Check the installed version of Volmarg personal-management-system (GitHub releases, tag v2.1.0 or earlier is affected).\n- Look for .php files in the upload directory under the web root, and for requests to /upload/send/ in web server logs.\n- Check whether the upload directory is served and executes PHP.","fix":"No fixed release known: v2.1.0 (27 Sep) is the latest on the project's releases page. Until one exists, restrict access to logged-in users you trust, block .php execution in the upload directory in the web server config, or take the instance off the internet.","status":"open","published_at":"2026-11-03T16:17:36+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:23:41+00:00","updated_at":"2026-11-03T16:25:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:23:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Volmarg Personal Management System: file upload lets logged-in users run PHP code","impact":"high","summary":"Volmarg Personal Management System through 2.1.0 lets any authenticated user upload PHP files through the /upload/send/ endpoint. An attacker can then request the uploaded file to run code as the web server user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["php","self-hosted","volmarg"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code as the web server user on the host","analyst_note":"Confirm whether a fixed release exists and check the vulncheck advisory for the upload endpoint details and affected configuration.","how_to_check":"- Check whether the Volmarg Personal Management System version in use is `2.1.0` or earlier\n- Look for an exposed /upload/send/ endpoint on the running instance\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","newer-than-2.1.0"],"who_is_affected":"Teams that self-host Volmarg Personal Management System through version 2.1.0 with user accounts enabled. The flaw requires an authenticated account, so instances open only to trusted staff carry less risk, but any user who can log in can reach the upload endpoint. The sources do not say whether a patched release exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4149,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed release exists and check the vulncheck advisory for the upload endpoint details and affected configuration.","search":"'-2026':16A,19A '-73328':17A,20A '/upload/send':49B,89C '2.1.0':39B,72C 'allow':80C 'attack':52B,91C 'auth':26B 'auth-requir':25B 'authent':42B,81C 'base64':94C 'code':14A,61B,109C 'contain':73C 'cve':15A,18A 'endpoint':50B,90C 'execut':108C 'file':5A,46B,58B,76C,86C 'filecont':95C 'filenam':99C 'host':32B 'let':7A,40B 'log':9A 'logged-in':8A 'manag':3A,36B,69C 'management':23A 'packag':28B 'person':2A,35B,68C 'personal':22A 'personal-management-system':21A 'php':13A,29B,45B,85C,98C 'request':55B,105C 'requir':27B 'root':103C 'run':12A,60B 'self':31B 'self-host':30B 'server':65B,113C 'submit':93C 'system':4A,24A,37B,70C 'unrestrict':75C 'upload':6A,44B,57B,77C,84C 'user':11A,43B,66B,82C,114C 'via':87C 'volmarg':1A,33B,34B,67C 'vulner':78C 'web':64B,102C,112C","nicknames":[],"mitigations":[],"who_affected":"Anyone self-hosting Volmarg Personal Management System (personal-management-system) 2.1.0 or earlier. An attacker needs a logged-in account, then can upload a .php file through /upload/send/ and request it to run code as the web server user. Single-user instances not exposed to the internet carry the least risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["personalmanagementsystem"],"ptokens":["management","personal","system"],"labels":["authrequired","high","package","php","selfhosted","volmarg"],"first_public_at":"2026-11-03T16:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73328","severity":null,"published_at":"2026-11-03T16:17:36+00:00","modified_at":"2026-11-03T16:17:36+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-73328:1504","url":null,"severity":null,"published_at":"2026-11-03T16:25:21+00:00","modified_at":"2026-11-03T16:25:21+00:00","first_seen_at":"2026-11-03T16:25:21+00:00","fetched_at":"2026-11-03T16:25:21+00:00","note":"VulnCheck advisory read (affects <=2.1.0, credit Florian Kabashi, refs GitHub issue #167, which I could not fetch). Releases page shows 2.1.0 as latest, no fix found. No exploit or PoC seen. Nothing marked verified: the only primary page is the maintainer's releases list, which does not mention the flaw."}],"documents":[{"id":58869,"url":"https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":12827,"url":"https://github.com/Volmarg/personal-management-system/releases","title":"Releases · Volmarg/personal-management-system","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}