CVE-2026-14777: SourceCodester LMS File Upload Vulnerability – Public Exploit Available

Technical summary

CVE-2026-14777 stems from insufficient access control and unrestricted file upload functionality in the announcements module. The vulnerability exists in /announcements.php and can be triggered by an authenticated user (CVSS vector indicates PR:L). Improper validation of uploaded files allows an attacker to bypass intended upload restrictions. The issue maps to CWE-284 (improper access control) and CWE-434 (unrestricted upload of dangerous file type), indicating both authorization and validation gaps in the upload handler.

Business impact

Organizations deploying this learning management system face direct operational risk. An attacker with valid credentials—whether a student, instructor, or provisioned account—can upload arbitrary files to the system. This enables payload delivery for subsequent attacks, potential code execution if upload directories are web-accessible, defacement of course content, or lateral movement within the infrastructure. Educational institutions using this product should assess whether sensitive student data, intellectual property, or accreditation materials could be compromised or disrupted.

Affected systems

The vulnerability affects SourceCodester Online Examination & Learning Management System version 1.0. The product name in the advisory contains a noted typographical error ('Onlne' instead of 'Online'). No additional version information or patch releases were provided in the source data; organizations should verify their exact installed version and check the vendor's advisory for a complete list of affected releases and any available patches.

Exploitability

This vulnerability has medium exploitability characteristics. It requires authentication (a valid user account) and presents no unusual complexity in execution. The CVSS vector (AC:L, PR:L, UI:N) reflects that exploitation is straightforward once credentials are obtained. Public availability of exploit code means threat actors have ready-made tools. The lack of user interaction requirement (UI:N) means an attacker can exploit this programmatically. However, the authentication requirement limits exposure to users with legitimate system access or those who can obtain credentials through phishing or credential stuffing.

Remediation

Immediate action is to restrict access to the /announcements.php endpoint and the upload functionality it provides. Disable the feature if not actively in use. Apply any available patches from SourceCodester—verify the vendor advisory for the appropriate version. Implement compensating controls: enforce strict file-type whitelisting, store uploads outside the web root, disable script execution in upload directories, and apply principle of least privilege to user roles. Consider implementing file integrity monitoring on upload directories and review access logs for unauthorized uploads.

Patch guidance

Contact SourceCodester directly or consult their official security advisory for patch availability and version numbers. Given this is a version 1.0 product, verify whether the vendor is actively maintaining this software and what their patching timeline is. If patches are unavailable or the product is unsupported, evaluate alternative learning management systems. Document the patch version applied and test thoroughly in a non-production environment before deployment, as file handling changes can affect legitimate course material uploads.

Detection guidance

Monitor /announcements.php for POST requests with file upload parameters from users with minimal privilege levels. Flag uploads of executable file types (.exe, .php, .jsp, .sh, .py) or archives containing such files to the announcements endpoint. Review web server and application logs for 201 (Created) or 200 responses following upload attempts, especially outside normal business hours or from unusual source IPs. Implement integrity monitoring on the upload directory to detect unexpected files. Check for webshell indicators and abnormal process execution spawning from the web server process.

Why prioritize this

Prioritize remediation within 30 days. While the CVSS score is MEDIUM (6.3), the combination of public exploit availability, straightforward exploitation, and direct impact on confidentiality, integrity, and availability warrants urgent action. Educational institutions should move this higher in the queue given the sensitivity of student and institutional data. The lack of KEV status does not diminish the practical risk—public exploits drive real-world attacks regardless of federal tracking.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects a network-accessible vulnerability requiring valid authentication, affecting core CIA properties (C:L, I:L, A:L). The low privilege requirement and lack of user interaction lower the barrier to exploitation. The score does not account for public exploit availability or the sensitivity of typical data in learning management systems, which should factor into organizational risk assessments. Verify the vector against the vendor advisory to ensure it reflects your deployment context.

Frequently asked questions