CVE-2026-10172: Bdtask Inventory Management RCE Flaw

CVE-2026-10172 Overview

CVE-2026-10172 is an unrestricted file upload vulnerability in Bdtask Multi-Store Inventory Management System 1.0. The flaw resides in the Upload function within application/modules/dashboard/controllers/Module.php, part of the Component Module. Attackers can manipulate the module parameter to upload arbitrary files without restriction. The issue is classified under [CWE-284] Improper Access Control. The exploit has been publicly released, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
A remote authenticated attacker can upload arbitrary files through the module parameter, potentially leading to webshell deployment and follow-on code execution on the host application server.

Affected Products

Bdtask Multi-Store Inventory Management System 1.0
Component: application/modules/dashboard/controllers/Module.php
Function: Upload

Discovery Timeline

2026-05-31 - CVE-2026-10172 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10172

Vulnerability Analysis

The vulnerability stems from missing access and content validation in the Upload function of the Module.php controller. The application accepts a user-supplied module argument and processes file upload data without enforcing restrictions on file type, extension, or MIME content. An authenticated user with low privileges can submit a crafted upload request and place an attacker-controlled file inside a web-accessible directory.

Because the upload routine sits behind a dashboard controller, the attack surface is reachable over the network once a low-privileged session is established. The combination of weak access control and unrestricted upload allows the attacker to stage payloads such as PHP webshells. EPSS modeling currently places this issue at low predicted exploitation activity, but a public proof of concept is available, which lowers the practical barrier for opportunistic operators.

Root Cause

The root cause is improper access control [CWE-284] combined with absent server-side validation of uploaded content. The Upload handler trusts the module parameter and the supplied file data without verifying extension allow-lists, MIME types, or the privilege level required to write into module directories.

Attack Vector

The attack is performed remotely over HTTP against the dashboard endpoint that maps to Module.php. The attacker authenticates with low-privileged credentials, submits a POST request to the module upload route, and supplies a malicious file along with a manipulated module argument. If the file lands inside a directory served by the web server, the attacker requests it directly to trigger execution.

No verified exploit code is reproduced here. Technical write-up and proof-of-concept artifacts are referenced in the GitHub CVE PoC Repository and the VulDB CVE Entry.

Detection Methods for CVE-2026-10172

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) under module or upload directories of the Bdtask application.
HTTP POST requests to dashboard routes invoking the Module/Upload action with non-standard module parameter values.
New files in the web root timestamped after low-privileged dashboard logins from unfamiliar source IP addresses.

Detection Strategies

Inspect web server access logs for POST requests targeting application/modules/dashboard/controllers/Module.php paired with multipart form data.
Monitor for outbound connections initiated by the PHP worker process shortly after upload activity, which can indicate webshell interaction.
Compare file system state of module directories against a known-good baseline to flag unauthorized additions.

Monitoring Recommendations

Forward web and PHP-FPM logs to a centralized analytics tier and alert on uploads that land outside expected media directories.
Track authentication events for low-privilege accounts followed by upload requests within a short window.
Enable file integrity monitoring on the application document root to detect new or modified script files.

How to Mitigate CVE-2026-10172

Immediate Actions Required

Restrict network access to the Bdtask dashboard to trusted administrative networks until a fix is applied.
Audit existing user accounts and revoke unnecessary low-privilege access that can reach the module upload endpoint.
Scan the web root for unauthorized files placed since the system was deployed and remove any suspicious artifacts.

Patch Information

No vendor patch has been published in the referenced advisories at the time of NVD publication. Monitor the VulDB Vulnerability Details entry for vendor updates and apply any official fix released by Bdtask as soon as it becomes available.

Workarounds

Configure the web server to deny execution of script files within upload and module directories using handler restrictions.
Add a web application firewall rule that blocks multipart uploads to the Module/Upload route from non-administrative sessions.
Enforce server-side allow-listing of permitted file extensions and validate MIME types before persisting uploaded content.

bash

# Example Apache configuration to block PHP execution in upload directories
<Directory "/var/www/bdtask/application/modules/dashboard/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>