# CVE-2026-38751: OpenSTAManager arbitrary file upload in module update functionality

Source: https://junglewise.ai/threats/cve-2026-38751-openstamanager-arbitrary-file-upload-in-module-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-38751 · Severity: high · CVSS 7.2 · Published 2026-05-04

OpenSTAManager, an open-source business management and e-billing software, contains a security flaw in its module update system. An attacker with administrative privileges can upload malicious files to the server, potentially leading to a complete takeover of the application and its database. This could result in the theft of sensitive customer data, financial records, or a total disruption of business operations.

Technologies: [Devcode Openstamanager](https://junglewise.ai/threats/technologies/openstamanager), [devcode-it/openstamanager (Packagist)](https://junglewise.ai/threats/technologies/devcode-it-openstamanager). Vendors: [Devcode](https://junglewise.ai/threats/vendors/devcode), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-38751 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38751 being exploited in the wild.

**How severe is CVE-2026-38751?** High severity, with a CVSS score of 7.2, published 4 May 2026.

**Which products and versions are affected?** devcode-it/openstamanager (Packagist) ECOSYSTEM:introduced=0,last_affected=2.10-beta.

**Is there a fix for CVE-2026-38751?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-38751 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-38751?** Check whether you run Devcode Openstamanager or devcode-it/openstamanager (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability (CWE-434) exists in OpenSTAManager versions 2.10 and earlier. The flaw is located in the 'modules/aggiornamenti/upload_modules.php' component, which handles module updates. A remote attacker with high privileges (administrative access) can exploit this by uploading a malicious PHP script or other dangerous file types. Successful exploitation allows for arbitrary code execution on the underlying server, potentially leading to full system compromise. While a proof-of-concept was referenced in initial reports, users are advised to restrict access to the update module and upgrade to a patched version if available.

## Affected products

- devcode-it OpenSTAManager up to and including 2.10

## Identifiers

- CVE-2026-38751
- GHSA-rm34-fg4m-39mw

## Timeline

- 2026-05-04: disclosed
- 2026-05-04: advisory

## References

- [https://github.com/devcode-it/openstamanager](https://github.com/devcode-it/openstamanager)
- [https://github.com/fuutianyii/poc](https://github.com/fuutianyii/poc)

## Related threats

- [OpenSTAManager HTML injection in group name](https://junglewise.ai/threats/cve-2026-44701-openstamanager-html-injection-in-group-name)
- [devcode-it OpenSTAManager SQL injection in confronta_righe.php](https://junglewise.ai/threats/cve-2026-35470-devcode-it-openstamanager-sql-injection-in-confronta-righe-php)
- [OpenSTAManager: SQL Injection via Aggiornamenti Module](https://junglewise.ai/threats/cve-2026-35168-openstamanager-sql-injection-via-aggiornamenti-module)
- [OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2](https://junglewise.ai/threats/cve-2026-29782-openstamanager-affected-by-remote-code-execution-via-insecure)
- [OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter](https://junglewise.ai/threats/cve-2026-28805-openstamanager-has-a-time-based-blind-sql-injection-via-options)