---
id: "CVE-2026-73328"
kind: "vulnerability"
aliases: ["CVE-2026-73328"]
title: "Volmarg Personal Management System: file upload lets logged-in users run PHP code"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "personal-management-system", "fixed": [], "affected": "<= 2.1.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["auth-required", "package", "php", "self-hosted", "volmarg"]
not_affected_if: ["newer-than-2.1.0", "unauthenticated-only-access"]
published_at: "2026-11-03T16:17:36+00:00"
first_seen_at: "2026-11-03T16:21:45+00:00"
updated_at: "2026-11-03T16:25:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73328", "first_seen_at": "2026-11-03T16:21:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T16:25:21+00:00"}]
---

# Volmarg Personal Management System: file upload lets logged-in users run PHP code

Volmarg Personal Management System through 2.1.0 lets any authenticated user upload PHP files through the /upload/send/ endpoint. An attacker can then request the uploaded file to run code as the web server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:personal-management-system affected <= 2.1.0 fixed ?

## How to check

- Check the installed version of Volmarg personal-management-system (GitHub releases, tag v2.1.0 or earlier is affected).
- Look for .php files in the upload directory under the web root, and for requests to /upload/send/ in web server logs.
- Check whether the upload directory is served and executes PHP.

## Fix

No fixed release known: v2.1.0 (27 Sep) is the latest on the project's releases page. Until one exists, restrict access to logged-in users you trust, block .php execution in the upload directory in the web server config, or take the instance off the internet.

## Timeline

- 2026-11-03T16:21:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73328
- 2026-11-03T16:25:21+00:00 analyst — VulnCheck advisory read (affects <=2.1.0, credit Florian Kabashi, refs GitHub issue #167, which I could not fetch). Releases page shows 2.1.0 as latest, no fix found. No exploit or PoC seen. Nothing marked verified: the only primary page is the maintainer's releases list, which does not mention the flaw.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send
- [fix] Releases · Volmarg/personal-management-system https://github.com/Volmarg/personal-management-system/releases

## From the sources

Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_