# CVE-2026-11474: Kushan2k student-management-system unrestricted upload in RegisterService.php

Source: https://junglewise.ai/threats/cve-2026-11474-kushan2k-student-management-system-unrestricted-upload-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-11474 · Severity: high · CVSS 7.3 · Published 2026-06-08

A security vulnerability exists in the Kushan2k Student Management System, a platform used for managing educational records. An attacker can upload malicious files through the student registration form because the system does not properly verify the type of files being uploaded. This could allow an unauthorized person to take complete control of the server, access sensitive student data, or disrupt school operations.

## Quick answers

**Is CVE-2026-11474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11474 being exploited in the wild.

**How severe is CVE-2026-11474?** High severity, with a CVSS score of 7.3, published 8 June 2026.

**Which products and versions are affected?** Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a.

**Is there a fix for CVE-2026-11474?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11474 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11474?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability exists in Kushan2k student-management-system up to commit f16a4ce. The flaw is located in the 'stimg' parameter handling within 'service/RegisterService.php' and 'controllers/RegisterController.php'. The application fails to validate file extensions or MIME types for student profile images, only checking file size before moving uploads to a web-accessible directory ('public/profiles/'). A remote, unauthenticated attacker can upload a PHP shell and execute arbitrary code by requesting the uploaded file. As of the advisory date, the vendor has not responded to the issue report.

## Affected products

- Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a

## Timeline

- 2026-05-20: disclosed: Issue reported to the project maintainer on GitHub.
- 2026-06-08: advisory: CVE published by VulDB.

## References

- [https://github.com/Kushan2k/student-management-system/](https://github.com/Kushan2k/student-management-system/)
- [https://github.com/Kushan2k/student-management-system/issues/1](https://github.com/Kushan2k/student-management-system/issues/1)
- [https://vuldb.com/cve/CVE-2026-11474](https://vuldb.com/cve/CVE-2026-11474)
- [https://vuldb.com/submit/833933](https://vuldb.com/submit/833933)
- [https://vuldb.com/vuln/369094](https://vuldb.com/vuln/369094)
- [https://vuldb.com/vuln/369094/cti](https://vuldb.com/vuln/369094/cti)