CVE-2026-14776: Unrestricted File Upload in SourceCodester Online Learning Management System 1.0

Technical summary

The vulnerability exists in the filename extension validation logic of /upload_files.php. The pathinfo function is manipulated to strip or spoof file extension checks, allowing bypass of upload restrictions. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) compounded by inadequate access controls (CWE-284). The flaw requires authentication but no additional user interaction. Successful exploitation enables arbitrary file upload, potentially leading to remote code execution depending on server configuration and the location where uploaded files are stored.

Business impact

Organizations deploying this LMS for student assessments face data confidentiality and integrity risks. An authenticated user—such as a disgruntled student or compromised instructor account—can upload webshells or malware to the server. If the web server executes uploaded files or serves them without proper MIME-type enforcement, attackers gain code execution, enabling data theft, system compromise, or use of the server for further lateral movement into institutional networks.

Affected systems

SourceCodester Online Examination & Learning Management System version 1.0 is confirmed vulnerable. Note that the product name in the CVE record contains a typo ('Onlne' instead of 'Online'). The CVE does not specify whether later versions have patched this issue; verification against SourceCodester's security advisories is essential.

Exploitability

This vulnerability scores CVSS 6.3 (Medium) under CVSS v3.1. Exploitation requires valid login credentials, making it a privilege escalation or insider-threat vector rather than a zero-authentication attack. However, the availability of public exploit code substantially lowers the barrier to weaponization. Any user with valid system access—including those with weak or compromised credentials—can trigger the flaw with trivial effort.

Remediation

Primary remediation is to upgrade to a patched version of the LMS; verify the specific patched release with SourceCodester's official security advisories. Interim controls include: (1) strict whitelist validation of uploaded file extensions and MIME types on the server side; (2) storage of uploads outside the web root or in a directory with disabled script execution; (3) implementation of file content scanning; (4) restriction of upload functionality to minimal user roles; (5) review and strengthen access controls for LMS accounts, particularly instructor and admin roles.

Patch guidance

Consult SourceCodester's official security updates and release notes to identify the patched version number and deployment steps. Given the public availability of exploits, patching should be prioritized in your change schedule. Test the patch in a staging environment before production deployment, particularly if you have customized the upload or file handling logic.

Detection guidance

Monitor web server and application logs for suspicious upload attempts to /upload_files.php, particularly: (1) requests with unusual or manipulated filename parameters; (2) uploads of executable file types (.php, .asp, .jsp, .exe, .sh); (3) uploads with null-byte sequences or double extensions; (4) multiple failed or successful uploads from a single user in short timeframes. Deploy file integrity monitoring on the upload directory. Review access logs for unauthorized script execution or web requests to newly uploaded files.

Why prioritize this

Although rated Medium severity due to the authentication requirement, the combination of public exploit availability, easy exploitability (AC:L), and the confidentiality/integrity impact warrants prompt attention. Educational institutions relying on this LMS for sensitive assessments should treat this as higher priority, especially if instructor or student accounts are at risk of compromise. Organizations with zero-trust or privileged-access-management policies may rate this lower if upload accounts are tightly controlled.

Risk score, explained

The CVSS 6.3 score reflects: (1) network-accessible attack vector; (2) low attack complexity (no special conditions required once authenticated); (3) requirement for low-privilege user interaction (valid login); (4) low confidentiality, integrity, and availability impact in isolation. The score does not account for context-dependent risks such as the file upload location, server execution environment, or compensating controls. Organizations with strong access controls may see lower practical risk; those with weak credential hygiene face higher residual risk.

Frequently asked questions