Executive brief
mjperpinosa stumasy, a student management and social networking platform, contains a security flaw in its post attachment feature. An attacker can bypass file upload restrictions to upload malicious scripts to the server. If exploited, this allows the attacker to execute arbitrary code, potentially leading to a full system takeover, data theft, or service disruption.
Technical details
An unrestricted file upload vulnerability exists in mjperpinosa stumasy within the `application/PHP/objects/updates/add_post.php` file. The root cause is a flawed validation logic in the `up_file_to_post` argument that uses an OR (||) operator when checking MIME types and file extensions. An attacker can bypass these checks by providing a malicious PHP file with a forged whitelisted MIME type (e.g., application/pdf). Because the application moves the uploaded file to a web-accessible directory (`documents/files/`) without sanitizing the filename or enforcing strict extension checks, the attacker can achieve Remote Code Execution (RCE) by directly requesting the uploaded PHP script. This vulnerability requires low-privileged user authentication and can be exploited remotely. No official patch has been released by the vendor.
Affected products
- mjperpinosa stumasy rolling release
Timeline
- 2026-05-16: disclosed: Issue reported to the project maintainer via GitHub
- 2026-06-04: advisory: CVE published by VulDB/NVD