Quick answers
- Is CVE-2026-90857 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90857 being exploited in the wild.
- How severe is CVE-2026-90857?
- Medium severity, with a CVSS score of 6.3, published 15 September 2026.
- Which products and versions are affected?
- SourceCodester College Notes Gallery Management System 1.0.
- Is there a fix for CVE-2026-90857?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-90857 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-90857?
- Check whether you run SourceCodester College Notes Gallery Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an unrestricted file upload vulnerability in the profile image upload handler at dashboard/userprofile.php. The root cause is insufficient server-side validation: the application only checks the client-supplied MIME type from $_FILES['image']['type'] against an allowlist and derives the filename extension from the original upload name using pathinfo(), without inspecting actual file content or blocking dangerous extensions. An authenticated attacker can upload a file named shell.php with a forged Content-Type header (e.g., image/jpeg), causing the application to store it as executable PHP in the publicly accessible profilepics/ directory. When the uploaded file is accessed via HTTP, the PHP payload executes in the web server context. No administrative privileges are required; any authenticated user can exploit this vulnerability.
Affected products
- SourceCodester College Notes Gallery Management System 1.0
Timeline
- 2026-08-13: disclosed: Vulnerability disclosed on GitHub
- 2026-09-15: advisory: CVE-2026-90857 published