Is CVE-2026-104637 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104637 being exploited in the wild.

How severe is CVE-2026-104637?

High severity, with a CVSS score of 7.3, published 2 October 2026.

Which products and versions are affected?

Onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.

How is CVE-2026-104637 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104637?

Check whether you run Onetwothreeneth HospitalManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104637: onetwothreeneth HospitalManagementSystem unrestricted file upload

CVE-2026-104637 · Severity: high · CVSS 7.3 · Published 2026-10-02

onetwothreeneth HospitalManagementSystem is a web application for managing hospital patient and physician records. An unauthenticated attacker can upload arbitrary PHP files through patient or physician forms and execute them directly, gaining full control of the web server. This allows theft of patient data, database credentials, and system compromise.

Technologies: Onetwothreeneth HospitalManagementSystem. Vendors: Onetwothreeneth.

Quick answers

Is CVE-2026-104637 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104637 being exploited in the wild.
How severe is CVE-2026-104637?: High severity, with a CVSS score of 7.3, published 2 October 2026.
Which products and versions are affected?: Onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d.
Is there a fix for CVE-2026-104637?: No fixed version is recorded yet. Restrict access to the img/ upload directory by disabling PHP execution (e.g., add `php_flag engine off` in .htaccess or configure Nginx/Apache to not process PHP in that directory). Implement file extension whitelisting, MIME type validation, and rename uploaded files to remove original extensions. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104637 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104637?: Check whether you run Onetwothreeneth HospitalManagementSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict access to the img/ upload directory by disabling PHP execution (e.g., add `php_flag engine off` in .htaccess or configure Nginx/Apache to not process PHP in that directory). Implement file extension whitelisting, MIME type validation, and rename uploaded files to remove original extensions.

Technical details

The vulnerability is an unrestricted file upload (CWE-434) in php/controller.php's add_patient, add_physician, and related functions. The img parameter is accepted without authentication, extension validation, or MIME checking, and written directly to the web-accessible img/ directory via move_uploaded_file(). An unauthenticated attacker can upload a PHP webshell and request it as a normal URL to achieve remote code execution as the web server user.

Affected products

onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d

Timeline

2026-09-07: disclosed: Issue reported on GitHub
2026-10-02: advisory: CVE-2026-104637 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.