Quick answers
- Is CVE-2026-108975 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-108975 being exploited in the wild.
- How severe is CVE-2026-108975?
- High severity, with a CVSS score of 7.3, published 13 October 2026.
- Which products and versions are affected?
- SourceCodester Library Management System 1.0.
- Is there a fix for CVE-2026-108975?
- No fixed version is recorded yet. Add exit; or die(); after every header('location:...') redirect in admin/session.php and other auth-checking files. Re-validate authorization at the start of add_admin.php and related handlers before executing file upload or database INSERT operations. Implement extension allowlists (jpg, jpeg, png, gif only) and use getimagesize() or finfo to verify file type; store uploads outside the web root or with randomized names; disable PHP execution in the upload directory via .htaccess (php_flag engine off). If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-108975 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-108975?
- Check whether you run SourceCodester Library Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Add exit; or die(); after every header('location:...') redirect in admin/session.php and other auth-checking files. Re-validate authorization at the start of add_admin.php and related handlers before executing file upload or database INSERT operations. Implement extension allowlists (jpg, jpeg, png, gif only) and use getimagesize() or finfo to verify file type; store uploads outside the web root or with randomized names; disable PHP execution in the upload directory via .htaccess (php_flag engine off).
Technical details
The vulnerability stems from missing exit() calls after authentication redirects in admin/session.php; unauthenticated requests receive a 302 redirect but the PHP page continues executing. The add_admin.php handler runs pre-auth and performs only size-based validation on file uploads (checks file size > 10MB), allowing .php files to be stored at predictable paths in /admin/upload/ with no extension filtering. The same handler hardcodes admin_type='Admin' when creating accounts, enabling attackers to establish persistent admin access and execute arbitrary code as root.
Affected products
- SourceCodester Library Management System 1.0
Timeline
- 2026-09-25: disclosed: Discovered and validated in local lab; advisory drafted but not sent to vendor or public