CVE-2025-70457
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-01-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| remyandrade | modern_image_gallery_app | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Remote Code Execution (RCE) issue in the Sourcecodester Modern Image Gallery App v1.0, specifically in the gallery/upload.php component. The app does not properly validate the contents of uploaded files and keeps the user-supplied file extension when saving. This flaw allows an unauthenticated attacker to upload malicious PHP code by pretending the file is an image, which can lead to full system compromise.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to execute arbitrary code on the affected system without authentication. This can result in full system compromise, including unauthorized access, data theft, data manipulation, or disruption of services.