CVE-2026-11474: Unrestricted File Upload in Kushan2k Student Management System

Technical summary

CVE-2026-11474 is an unrestricted file upload vulnerability affecting the Registration Endpoint in service/RegisterService.php. The vulnerability stems from insufficient input validation on the 'stimg' parameter, allowing remote unauthenticated attackers to upload arbitrary files. This bypasses access controls that should govern file storage operations, as indicated by the CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload) classifications. The CVSS 3.1 score of 7.3 reflects network accessibility, low attack complexity, and the confidentiality, integrity, and availability impacts of arbitrary file upload.

Business impact

Unrestricted file uploads can lead to remote code execution if the uploaded files are executable or interpreted by the web server. Attackers could deface the student management system, steal sensitive educational records, deploy malware, or pivot to broader network compromise. For educational institutions relying on this system, operational disruption, regulatory violations (e.g., FERPA for student data), and reputational harm are significant concerns. The presence of public exploits increases the window of exposure for unpatched deployments.

Affected systems

Kushan2k student-management-system installations up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a are affected. The project uses a rolling release model without discrete version numbers, making it difficult to identify precisely which deployed instances are vulnerable. Any organization running this system should assume their deployment is at risk unless they have explicitly updated past the vulnerable commit.

Exploitability

Exploitation is straightforward: an unauthenticated remote attacker can craft a request to the registration endpoint, manipulate the 'stimg' parameter to inject a malicious file, and trigger the upload. No user interaction is required. The availability of public exploit code and the low technical barrier to weaponization mean that both opportunistic and targeted attacks are probable. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, but public disclosure has already occurred.

Remediation

The development team must implement strict file upload controls, including whitelist-based file type validation, file storage outside the web root, and verification that uploaded content matches declared file types. Until an official patch is available, organizations should implement network-level restrictions to limit access to the registration endpoint, disable the registration feature if operationally feasible, or run the application behind a Web Application Firewall (WAF) with rules to detect and block suspicious file uploads.

Patch guidance

Because the Kushan2k project uses continuous rolling releases without traditional versioning, consult the project repository directly to confirm whether your deployment includes commits dated after the vulnerability discovery (June 8, 2026). Monitor the project's issue tracker and commit history for security fixes. As the vendor has not yet responded to the early disclosure, verify whether a fix has been merged and test it thoroughly in a staging environment before production deployment. If no patch is forthcoming within a reasonable timeframe, consider migrating to an alternative, actively maintained student management system.

Detection guidance

Monitor web server logs for POST requests to the registration endpoint with unusual or suspicious 'stimg' parameter values, particularly those containing encoded payloads, executable extensions (.php, .jsp, .exe), or system commands. Monitor the upload directory for newly created files with unexpected names, timestamps, or types. Implement intrusion detection rules to flag attempts to upload files with double extensions or null-byte injection. Review file permissions on the upload directory to ensure the web server process cannot execute stored files. Conduct file integrity monitoring on the upload location to detect unauthorized additions.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS severity, unauthenticated remote exploitability, confirmed public exploitation, and potential for rapid compromise. The lack of vendor response and the rolling-release model add urgency—you cannot rely on a forthcoming patch. File upload vulnerabilities are frequently leveraged in attack chains leading to code execution and full system compromise, particularly in web applications handling sensitive data like student records.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires no privileges (PR:N) or user interaction (UI:N). The impact spans confidentiality, integrity, and availability (C:L/I:L/A:L), as arbitrary file uploads can lead to data exfiltration, system modification, and service disruption. The score appropriately elevates the risk from the base impact; however, the real-world threat is amplified by public exploit availability and the educational value of student management systems as targets for data theft.

Frequently asked questions