Unrestricted File Upload in Volmarg Personal Management System

Executive Summary

CVE-2026-73328 is an unrestricted file upload vulnerability in Volmarg Personal Management System through version 2.1.0. Authenticated users can upload PHP files via the /upload/send/ endpoint by submitting base64-encoded file content with a .php filename. The files are stored in the web root, allowing attackers to execute arbitrary code as the web server user.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected PHP files in the web root directory. Use commands like 'find /var/www/html -name "*.php" -type f' to locate suspicious files. Monitor upload directories for files with .php extensions or unusual names. Inspect network traffic for POST requests to /upload/send/ with base64-encoded content.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to upload malicious PHP files, execute arbitrary code on the server, gain unauthorized access, steal sensitive data, or compromise the entire system. Since the system is self-hosted, this could affect local networks or devices running the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the /upload/send/ endpoint if possible. Implement strict file type allowlists in FileUploadConfigurator.php. Ensure FileUploadValidator.php enforces non-empty extension and MIME type checks. Update to a patched version if available. Restrict web server permissions to prevent PHP execution in upload directories.

Useful 0 Not Useful 0