CVE-2026-10172: Bdtask Multi-Store Inventory 1.0 Unrestricted File Upload Vulnerability

Technical summary

The vulnerability exists in the Upload function of the Module component (application/modules/dashboard/controllers/Module.php) in Bdtask version 1.0. The module parameter is not properly validated before being used in file upload operations, enabling unrestricted file uploads. The attack requires low privileges (authenticated user) and no user interaction. CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type) indicate that access controls and upload restrictions are insufficiently enforced.

Business impact

Successful exploitation enables attackers to upload executable or malicious files, potentially leading to system compromise, data theft, or lateral movement within the network. Organizations using Bdtask for inventory management may face operational disruption, data loss, or compliance violations if customer or business data is exfiltrated. The availability of public exploits significantly accelerates the timeline for active attacks.

Affected systems

Bdtask Multi-Store Inventory Management System version 1.0 is affected. Any deployment of this application is vulnerable if users have not applied patching or compensating controls. Verify your Bdtask installation version and confirm whether you are running version 1.0 or a newer patched release.

Exploitability

Exploitability is moderate to high. The attack requires authentication (reducing immediate exposure to anonymous attackers) but public exploit code is available, making weaponization straightforward for threat actors with valid credentials or those who have compromised user accounts. The network-accessible nature and low complexity further lower the barrier to exploitation.

Remediation

Prioritize upgrading Bdtask to a patched version beyond 1.0. Verify patch availability directly from the Bdtask vendor advisory. Implement file upload restrictions and validation: restrict allowed file types, enforce filename sanitization, store uploads outside the web root, and disable script execution in upload directories. Apply additional access controls to the dashboard module and monitor upload activity.

Patch guidance

Check the Bdtask vendor website or security advisory for patched versions released after 1.0. Apply the patch in a test environment first and validate that inventory functionality remains intact. If vendor patches are unavailable, implement compensating controls immediately: disable the upload feature if not in use, restrict access to the Module component via network controls, or temporarily disable the dashboard module until a patch is available.

Detection guidance

Monitor application logs for unusual file uploads to the dashboard module, particularly suspicious file extensions (exe, php, sh, jsp, etc.). Review web server access logs for POST requests to the upload endpoint with unexpected file types. Implement file integrity monitoring on the upload directory. Search for indicators of Web shells or executable files in unexpected locations. If a WAF is deployed, create rules to block uploads of dangerous file types to this endpoint.

Why prioritize this

Although the CVSS score of 6.3 is medium, the presence of public exploits, low attack complexity, and the ability to achieve code execution elevate practical risk. Any organization running Bdtask 1.0 should treat this as high priority due to the ease of exploitation and immediate availability of attack tools.

Risk score, explained

CVSS 3.1 score of 6.3 reflects the combination of network accessibility, low attack complexity, and the requirement for authentication. The score would be higher if the vulnerability allowed unauthenticated upload. However, the public availability of exploits and the potential for remote code execution warrant faster remediation timelines than the base CVSS score alone suggests.

Frequently asked questions