CVE-2026-108973
Received Received - Intake

Unrestricted File Upload in Contact Tracing System 1.0

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108973
EUVD
EUVD-2026-98313

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SourceCodester Contact Tracing System 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload issue in SourceCodester Contact Tracing System 1.0. The flaw exists in the move_uploaded_file function of the Users.php file, specifically in the /classes/Users.php?f=save endpoint. An attacker can manipulate the img/id parameter to upload arbitrary files without restrictions, enabling remote exploitation.

Detection Guidance

Detecting this vulnerability requires checking for unrestricted file uploads in the Contact Tracing System. Inspect the /classes/Users.php file for the move_uploaded_file function usage. Look for improper validation of the img/id parameter in upload requests.

Impact Analysis

This vulnerability allows remote attackers to upload malicious files to the server. This could lead to remote code execution, defacement of the website, or further attacks against users visiting the compromised system. Sensitive data may also be exposed or modified.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Immediately restrict file uploads to trusted sources only. Validate file types strictly and implement server-side checks. Disable the move_uploaded_file function in Users.php if not required. Monitor network traffic for suspicious upload attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart