Is CVE-2026-10806 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10806 being exploited in the wild.

How severe is CVE-2026-10806?

Medium severity, with a CVSS score of 6.3, published 4 June 2026.

Which products and versions are affected?

Mjperpinosa Stumasy rolling release.

Is there a fix for CVE-2026-10806?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10806 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10806?

Check whether you run Mjperpinosa Stumasy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10806: mjperpinosa stumasy unrestricted file upload in add_post.php

CVE-2026-10806 · Severity: medium · CVSS 6.3 · Published 2026-06-04

mjperpinosa stumasy, a student management and social networking platform, contains a security flaw in its post attachment feature. An attacker can bypass file upload restrictions to upload malicious scripts to the server. If exploited, this allows the attacker to execute arbitrary code, potentially leading to a full system takeover, data theft, or service disruption.

Technologies: Mjperpinosa Stumasy. Vendors: Mjperpinosa.

Quick answers

Is CVE-2026-10806 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10806 being exploited in the wild.
How severe is CVE-2026-10806?: Medium severity, with a CVSS score of 6.3, published 4 June 2026.
Which products and versions are affected?: Mjperpinosa Stumasy rolling release.
Is there a fix for CVE-2026-10806?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10806 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10806?: Check whether you run Mjperpinosa Stumasy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability exists in mjperpinosa stumasy within the `application/PHP/objects/updates/add_post.php` file. The root cause is a flawed validation logic in the `up_file_to_post` argument that uses an OR (||) operator when checking MIME types and file extensions. An attacker can bypass these checks by providing a malicious PHP file with a forged whitelisted MIME type (e.g., application/pdf). Because the application moves the uploaded file to a web-accessible directory (`documents/files/`) without sanitizing the filename or enforcing strict extension checks, the attacker can achieve Remote Code Execution (RCE) by directly requesting the uploaded PHP script. This vulnerability requires low-privileged user authentication and can be exploited remotely. No official patch has been released by the vendor.

Affected products

mjperpinosa stumasy rolling release

Timeline

2026-05-16: disclosed: Issue reported to the project maintainer via GitHub
2026-06-04: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.