Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-102842: gedelumbung HospitalManagement allows remote file upload
CVE-2026-102842 · published 19 days ago
Summary
The HospitalManagement system’s login component can be tricked into accepting any file from an outside user. This means an attacker could place malicious files on the server and potentially run them. Apply any available updates, limit file‑upload permissions, and monitor for unexpected files to reduce the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gedelumbung | hospitalmanagement | c2d45543789a3887067d3915f69d44cfc2cf76a8 |
Original advisory text
gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument ADMIN_RS_KCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1028... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102842 Vendor Advisory
- https://vuldb.com/vuln/411501
- https://vuldb.com/vuln/411501/cti
- https://vuldb.com/cve/CVE-2026-102842
- https://vuldb.com/submit/946238
- https://github.com/gedelumbung/HospitalManagement/issues/8
- https://github.com/gedelumbung/HospitalManagement/
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
CWE-434Unrestricted File Upload
Timeline
Published30 Sep 2026
Updated19 Oct 2026
First seen30 Sep 2026
Track software like this
Free during beta