CVE-2026-119620 in cak-filemanagement-system
Summary
by MITRE • 10/30/2026
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability resides within the cak-filemanagement-system, specifically affecting versions ranging up to commit 5e6433246475e66462e1fea980688de96a049297. This security flaw is located in the admin/add_logs.php script and centers on the improper handling of file uploads via the PHP function move_uploaded_file. The core technical deficiency involves a lack of sufficient validation or sanitization for the File argument passed to this function. Consequently, an attacker can manipulate this input parameter to bypass intended restrictions, leading to unrestricted file upload capabilities. This type of flaw is classically categorized under CWE-434, which describes the ability to upload dangerous types of files that may be executed by a web server or interpreted by client-side scripts.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of the resulting access. Because the affected function resides in an administrative script, successful exploitation allows an attacker to bypass authentication controls if they can reach the endpoint, or more critically, upload malicious payloads such as web shells into a directory that may be accessible via HTTP. Once uploaded, these files enable arbitrary code execution on the target server. This aligns with MITRE ATT&CK technique T1505.003, known as Web Shell, where attackers install backdoors to maintain persistent access and facilitate further lateral movement within the compromised network environment. The fact that this exploit has been publicly disclosed significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage existing proof-of-concept code to identify and compromise vulnerable instances without needing to develop custom exploits from scratch.
The project maintainers were notified of this issue through an official report but have not yet provided a response or issued a patch. This lack of engagement leaves users in a state of prolonged exposure, as the vulnerability remains unmitigated in the affected codebase versions. In such scenarios where vendor remediation is delayed, immediate mitigation strategies must be implemented by system administrators and security teams to reduce the attack surface. Recommended defensive measures include implementing strict allowlists for file extensions at both the application level and via web server configuration rules. Additionally, deploying Web Application Firewalls with signatures capable of detecting upload-based attacks can provide a layer of defense against exploitation attempts. It is also critical to ensure that uploaded files are stored in directories outside the web root or have execute permissions disabled on those specific paths to prevent direct execution even if an attacker succeeds in uploading a malicious script.