Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-10807: mjperpinosa stumasy allows remote file upload

CVE-2026-10807 · published 5 months ago

Summary

The change_profile_image.php script in the mjperpinosa stumasy application lets anyone send a specially crafted request to upload files without restriction. This could let an attacker place malicious files on the server, potentially leading to further compromise. Apply any available patches from the project or limit file upload permissions until a fix is released.

Original advisory text

mjperpinosa stumasy change_profile_image.php unrestricted upload

A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10807... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-10807 Vendor Advisory
https://vuldb.com/submit/831551 Vendor Advisory
https://vuldb.com/vuln/368255 Vendor Advisory
https://github.com/mjperpinosa/stumasy/issues/3 Third Party Advisory
https://vuldb.com/vuln/368255/cti Third Party Advisory
https://github.com/mjperpinosa/stumasy/ URL
https://vuldb.com/cve/CVE-2026-10807 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-434Unrestricted File Upload

Timeline

Published4 Jun 2026

Updated29 Oct 2026

First seen4 Jun 2026

Sources

CVE-2026-10807 · NVD

CVE-2026-10807 · OSV

Track software like this

Free during beta