CVE-2026-112149: vraj404 Criminal-Management-System unrestricted file upload

CVE-2026-112149 · Severity: high · CVSS 7.3 · Published 2026-10-19

The Criminal-Management-System is a web-based PHP application for managing criminal records. An unauthenticated attacker can upload arbitrary files through the image upload feature in home.php without any validation, then execute uploaded PHP code to read sensitive files like database credentials or run system commands on the server.

Technologies: Vraj404 Criminal Management System. Vendors: Vraj404.

Quick answers

Is CVE-2026-112149 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112149 being exploited in the wild.
How severe is CVE-2026-112149?
High severity, with a CVSS score of 7.3, published 19 October 2026.
Which products and versions are affected?
Vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4.
Is there a fix for CVE-2026-112149?
No fixed version is recorded yet. Implement file upload validation including authentication checks, file extension whitelisting, MIME type validation, and file content inspection. Store uploaded files outside the web root with randomly generated filenames and serve them through a dedicated handler that prevents execution.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112149 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-112149?
Check whether you run Vraj404 Criminal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Implement file upload validation including authentication checks, file extension whitelisting, MIME type validation, and file content inspection. Store uploaded files outside the web root with randomly generated filenames and serve them through a dedicated handler that prevents execution.</anigation> </invoke>

Technical details

The vulnerability is an unrestricted file upload (CWE-434) in home.php's move_uploaded_file() call that accepts the my_img parameter without authentication, file extension validation, MIME type checking, or filename sanitization. An unauthenticated remote attacker can upload a PHP file to the web-served images/ directory and execute arbitrary code with the privileges of the web server process, reading config.php or executing system commands depending on PHP configuration.

Affected products

  • vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4

Timeline

  • 2026-10-05: disclosed: Issue reported to project via GitHub issue #1
  • 2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.