CVE-2026-77681
Received Received - Intake

Unrestricted File Upload in CodeAstro Online Job Portal

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulDB

Description
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77681
EUVD
EUVD-2026-63876

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
codeastro online_job_portal 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an arbitrary file upload flaw in CodeAstro Online Job Portal 1.0. The issue occurs in the /users/update-profile.php file where the Name argument is manipulated to allow unrestricted file uploads. Attackers can upload malicious files, such as PHP shells disguised as images, which can lead to remote code execution or server compromise.

Detection Guidance

To detect this vulnerability, inspect the /users/update-profile.php file for improper file upload handling. Check for unexpected file uploads, especially PHP or executable files disguised as images. Review server logs for POST requests to this endpoint with unusual file extensions or content types.

Impact Analysis

An attacker could exploit this to upload malicious scripts, gaining control over the server. This may result in data theft, unauthorized access to sensitive information, or complete takeover of the system hosting the job portal.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict file uploads to trusted directories and disable PHP execution in image directories. Implement strict file type validation by checking both file extensions and MIME types. Rename uploaded files to random strings to prevent path traversal or execution of malicious scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart