# CVE-2026-18927: imranrisal-dev Student-Management-System unrestricted file upload in profile image handler

Source: https://junglewise.ai/threats/cve-2026-18927-imranrisal-dev-student-management-system-unrestricted-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18927 · Severity: medium · CVSS 6.3 · Published 2026-08-05

A student management web application accepts profile image uploads without validating file types, allowing attackers with basic user accounts to upload arbitrary files including scripts. If the web server executes PHP files in the upload directory, an attacker can gain remote code execution and full control of the server. Even without PHP execution, attackers can host malicious content or conduct phishing attacks.

## Quick answers

**Is CVE-2026-18927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18927 being exploited in the wild.

**How severe is CVE-2026-18927?** Medium severity, with a CVSS score of 6.3, published 5 August 2026.

**Which products and versions are affected?** imranrisal-dev Student-Management-System commit 18ea7904c339e0c7b0234724a79c939ce6191def and a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c.

**Is there a fix for CVE-2026-18927?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18927 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18927?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unrestricted file upload flaw in the student_profile_pic.php component's storeProfileImage function. The application accepts file uploads via the choose_file parameter without validating file type, MIME type, file extension, or file contents. The server uses the original user-supplied filename directly when storing the upload in a web-accessible directory (../../asset/upload/), then passes it to move_uploaded_file(). An authenticated attacker (any student or staff user) can upload a PHP file or other executable content that will be stored and executed by the web server. The vulnerability requires network access and valid credentials but no user interaction beyond file upload. Public disclosure and exploitation code are available. No patch information has been released as the vendor did not respond to early disclosure attempts.

## Affected products

- imranrisal-dev Student-Management-System commit 18ea7904c339e0c7b0234724a79c939ce6191def and a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c

## Timeline

- 2026-06-16: disclosed: Public disclosure on GitHub with proof-of-concept
- 2026-08-05: advisory: CVE-2026-18927 published
- 2026: other: Vendor contacted early but did not respond

## References

- [https://github.com/sanjibsajid381-ctrl/My-Web-cve/issues/1](https://github.com/sanjibsajid381-ctrl/My-Web-cve/issues/1)
- [https://vuldb.com/cve/CVE-2026-18927](https://vuldb.com/cve/CVE-2026-18927)