Quick answers
- Is CVE-2026-10807 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10807 being exploited in the wild.
- How severe is CVE-2026-10807?
- Medium severity, with a CVSS score of 6.3, published 4 June 2026.
- Which products and versions are affected?
- Mjperpinosa Stumasy rolling release.
- Is there a fix for CVE-2026-10807?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-10807 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-10807?
- Check whether you run Mjperpinosa Stumasy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unrestricted file upload vulnerability exists in `application/PHP/objects/profiles/change_profile_image.php` within the mjperpinosa stumasy student management system. The root cause is flawed validation logic that uses an OR condition to check either the client-supplied MIME type or the file extension against a whitelist. An attacker can bypass this by forging the `Content-Type` header to a permitted image type (e.g., image/png) while uploading a file with a `.php` extension. The application then saves the file to a web-accessible directory (`/documents/images/`) with its original extension, allowing the attacker to execute arbitrary PHP code by requesting the uploaded file. As of the advisory date, the project has not responded to the issue report.
Affected products
- mjperpinosa stumasy rolling release
Timeline
- 2026-05-16: disclosed: Issue reported on GitHub repository
- 2026-06-04: advisory: CVE published by VulDB/NVD