CVE-2026-26699
Arbitrary Code Execution in Personnel Property Equipment System
Publication date: 2026-03-02
Last updated on: 2026-03-04
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jon-remus-sevellejo | personnel_property_equipment_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in sourcecodester Personnel Property Equipment System v1.0 exists in the file ip/ppes/admin/admin_change_picture.php, where it allows an attacker to execute arbitrary code on the affected system.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to run arbitrary code on the system, potentially leading to unauthorized access, data theft, system compromise, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability exists in the file ip/ppes/admin/admin_change_picture.php of the sourcecodester Personnel Property Equipment System v1.0, allowing arbitrary code execution.
To detect this vulnerability on your system, you can check for the presence of the vulnerable file and test if it is accessible and exploitable.
- Use curl or wget to send crafted requests to the admin_change_picture.php endpoint to see if arbitrary code execution is possible.
- Example command: curl -v --data-binary @exploit_payload.txt http://target-ip/ip/ppes/admin/admin_change_picture.php
- Check web server logs for suspicious POST requests to admin_change_picture.php.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable admin_change_picture.php file.
- Limit access to the admin directory by IP address or authentication.
- Apply input validation and sanitization on the admin_change_picture.php script to prevent arbitrary code execution.
- If possible, remove or disable the vulnerable functionality until a patch is available.
- Monitor logs for any suspicious activity targeting this endpoint.