CVE-2026-95820

Received Received - Intake

Unrestricted File Upload in College-Notes-Gallery

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulDB

Description

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted upload. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-95820

EUVD

EUVD-2026-84978

Affected Vendors & Products

Vendor	Product	Version / Range
anirbandutta9	college-notes-gallery	to 8c1cf3d98f30982d069c88ca172612c001eb39f6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an unrestricted file upload issue in the College-Notes-Gallery application. It exists in the /dashboard/userprofile.php file where the 'image' argument can be manipulated to upload files without restrictions. The attack can be performed remotely and a public exploit is available.

Detection Guidance

This vulnerability involves unrestricted file upload via manipulation of the 'image' argument in /dashboard/userprofile.php?section=admin1. To detect it, inspect web server logs for unusual POST requests to this path with file upload parameters. Check for uploaded files with unexpected extensions or locations. Review file upload functionality in the application for improper validation.

Impact Analysis

An attacker could upload malicious files to the server, potentially leading to remote code execution, data theft, or defacement. Users with access to the system could have unauthorized files placed on the server, compromising its integrity and security.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Immediately restrict access to the /dashboard/userprofile.php file, especially the section=admin1 parameter. Disable file uploads in the application if not required. Monitor network traffic for unusual uploads or POST requests to this endpoint. Apply input validation and file type restrictions on the image parameter to prevent unrestricted uploads.

Hi! I’m here to help you understand CVE-2026-95820. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70