CVE-2026-14775: Authenticated File Upload Vulnerability in SourceCodester LMS 1.0

Technical summary

CVE-2026-14775 is a classic improper access control vulnerability (CWE-284) combined with unrestricted file upload (CWE-434) in SourceCodester Online Examination & Learning Management System 1.0. The vulnerability exists in /process_lesson.php where insufficient validation of the user_id parameter allows authenticated users to circumvent upload restrictions. An attacker with valid credentials can craft requests that bypass intended file type or destination controls, leading to arbitrary file placement on the server. The CVSS 3.1 score of 6.3 (MEDIUM) reflects the requirement for authentication, though the impact includes confidentiality, integrity, and availability risks.

Business impact

Organizations deploying this learning management system face data exfiltration risk through uploaded files, potential malware injection into the educational environment, and system compromise. Attackers could introduce malicious files into lesson materials, compromising student and instructor systems that download content. The threat is heightened by public exploit availability, which lowers the skill barrier for attacks. Institutions managing sensitive student records or operating in regulated sectors face compliance and liability concerns if unauthorized file uploads lead to data exposure.

Affected systems

SourceCodester Online Examination & Learning Management System version 1.0 is affected. The product name appears in the source data with a typo ('Onlne'). Organizations should verify their deployment versions against SourceCodester's official documentation to confirm if they run version 1.0 or earlier patches. The vendor product list in the source data is empty, so confirm version affiliation directly with SourceCodester.

Exploitability

Exploitability is high relative to the CVSS score. The vulnerability requires authenticated access (valid login credentials) but does not require elevated privileges within the system. An attacker with a standard user account can execute the exploit. Critically, public exploit code is available, eliminating the need for sophisticated attack development. The attack surface includes any endpoint where the LMS accepts user uploads, making detection challenging if logging is insufficient. Network accessibility is direct (no complex network topology required).

Remediation

Update to a patched version released by SourceCodester after 2026-07-07 (the modification date of this CVE entry). Apply vendor patches immediately given the public exploit availability and authenticated attack path. If patches are not yet available from the vendor, implement compensating controls: restrict file upload functionality at the web application firewall level, enforce strict file type whitelisting, isolate the /process_lesson.php endpoint with IP-based access controls, and monitor upload activities for anomalies. Verify patch versions against the official SourceCodester security advisory.

Patch guidance

Check SourceCodester's official security advisories and update portal for version 1.0 patch releases. Apply updates in a test environment first to ensure compatibility with existing lesson content and user data. After patching, validate that file upload restrictions are properly enforced by testing with non-standard file types. Monitor application logs post-deployment for any blocked upload attempts, which may indicate attack attempts. If SourceCodester has not yet released patches, prioritize compensating controls as described in the remediation section.

Detection guidance

Monitor /process_lesson.php for POST/PUT requests with suspicious user_id parameter values—particularly those that differ from the authenticated user's actual ID or contain path traversal sequences. Log and alert on file uploads with mismatches between declared file type and actual content (e.g., executable files with image extensions). Examine uploaded files for unexpected MIME types or file signatures. Implement Web Application Firewall rules to restrict file extensions uploaded via this endpoint to known-safe types. Review access logs for rapid or bulk upload attempts by single users, which may indicate automated exploitation.

Why prioritize this

Despite the MEDIUM CVSS score, this vulnerability merits prompt attention due to: (1) public exploit availability eliminating development friction for attackers, (2) the direct path to system compromise through arbitrary file upload, (3) threat to sensitive educational data and student records, and (4) the relatively low skill barrier—any authenticated user can exploit it. Educational institutions and training platforms are frequent targets for data theft. Prioritize patching ahead of lower-severity vulnerabilities that lack public exploits.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a medium severity assessment: authentication is required (lowering severity), but the attack is network-accessible and requires no user interaction beyond login. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates that successful exploitation impacts confidentiality (via uploaded malware accessing files), integrity (via modified or injected files), and availability (via resource exhaustion or denial-of-service through large uploads). The score does not fully account for the real-world risk amplified by public exploit code and the educational sector's reliance on file-based course content distribution.

Frequently asked questions