CVE-2026-108922
Received Received - Intake

Unrestricted File Upload in KusalkaSilva Learning-Management-System

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108922
EUVD
EUVD-2026-97780

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in the KusalkaSilva Learning-Management-System. It affects the function getimagesize in upload_save.php, allowing attackers to manipulate the uploaded_file/image argument to bypass restrictions and upload malicious files. The system fails to properly validate file types, enabling remote code execution.

Detection Guidance

Check for suspicious file uploads in the admin/uploads/ directory. Look for unexpected PHP files or files with unusual extensions. Review web server access logs for POST requests to upload_save.php or teacher_avatar.php with non-standard file types.

Impact Analysis

An attacker could exploit this to upload a PHP web shell, gaining full control over the server. This includes accessing sensitive data, modifying files, and moving laterally within the network. The attack can be launched remotely without authentication due to a separate SQL injection flaw in the login system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA due to unauthorized access to sensitive data, potential data breaches, and lack of proper access controls. Organizations using this system may face legal penalties and reputational damage.

Mitigation Strategies

Disable file uploads in upload_save.php and teacher_avatar.php if not required. Implement strict file type validation to block executable files and scripts. Move the upload directory outside the web root or restrict execution permissions. Update the system to enforce authentication for upload endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart