CVE-2026-11474 Overview
CVE-2026-11474 is an unrestricted file upload vulnerability in the Kushan2k student-management-system project. The flaw resides in the service/RegisterService.php file within the Registration Endpoint component. An attacker can manipulate the stimg argument to upload arbitrary files without restriction. The issue is mapped to [CWE-284] (Improper Access Control) and affects all commits up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Because the project uses a rolling release model, no fixed version identifier exists. The exploit has been disclosed publicly and the upstream maintainer has not responded to the issue report.
Critical Impact
Remote, unauthenticated attackers can upload arbitrary files through the registration endpoint, enabling potential web shell deployment and follow-on compromise of the hosting application.
Affected Products
- Kushan2k student-management-system (all commits up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a)
- Component: Registration Endpoint (service/RegisterService.php)
- Distribution model: rolling release (no discrete version identifier)
Discovery Timeline
- 2026-06-08 - CVE-2026-11474 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11474
Vulnerability Analysis
The vulnerability stems from improper access control over file upload handling in service/RegisterService.php. The stimg parameter, used during user registration to accept a student image, does not enforce restrictions on the file type, extension, content, or destination path. An attacker can submit a crafted HTTP POST request to the registration endpoint and place attacker-controlled content into a server-accessible location. When the upload directory is reachable by the web server and PHP execution is enabled, the attacker can transition from arbitrary write to remote code execution by uploading a PHP web shell.
The issue is network-reachable, requires no authentication, and requires no user interaction. The exploit is publicly available, which lowers the barrier to opportunistic attacks against exposed deployments.
Root Cause
The root cause is the absence of server-side validation on file upload input. The handler accepts the stimg argument and writes it to disk without verifying MIME type, file extension allowlists, magic-byte content checks, or randomized destination filenames. This maps to [CWE-284] Improper Access Control and overlaps with the unrestricted file upload weakness pattern.
Attack Vector
An unauthenticated remote attacker sends a multipart HTTP POST request to the registration endpoint with a stimg field containing a malicious payload such as a .php file. Because the destination is server-writable and likely served by the same PHP interpreter, the attacker then issues a follow-up HTTP request to the uploaded path to trigger execution. No prior account, token, or session is required.
Verified technical details are documented in the VulDB entry for CVE-2026-11474 and the upstream GitHub issue.
Detection Methods for CVE-2026-11474
Indicators of Compromise
- Unexpected files with executable extensions (.php, .phtml, .phar) written under the application's upload or image directory.
- HTTP POST requests to the registration endpoint where the stimg multipart field contains non-image content or a non-image extension.
- Web server access logs showing GET requests directly to user-uploaded image filenames returning HTTP 200 with non-image MIME responses.
- Outbound network connections initiated by the PHP worker process shortly after a registration request.
Detection Strategies
- Inspect web server and application logs for POST requests to service/RegisterService.php with anomalous file extensions in the stimg parameter.
- Compare files in the upload directory against an allowlist of expected image MIME types using server-side magic-byte validation.
- Deploy file integrity monitoring on the upload directory to alert on creation of script-executable files.
- Use a web application firewall rule to block multipart uploads with executable MIME types or double extensions such as image.jpg.php.
Monitoring Recommendations
- Alert on any PHP process spawning shell interpreters (sh, bash, cmd.exe) following a request to the registration endpoint.
- Monitor for newly created files under the web root whose extension does not match an image allowlist.
- Track HTTP request patterns where the same source IP performs an upload immediately followed by a GET to the uploaded resource path.
How to Mitigate CVE-2026-11474
Immediate Actions Required
- Restrict public access to the affected registration endpoint until the upload logic is hardened.
- Disable PHP execution in the upload directory via web server configuration (for example, an .htaccess deny rule or Nginx location block).
- Audit the upload directory for any files created after the application was exposed and remove unauthorized artifacts.
- Rotate any credentials, API keys, or secrets that were accessible from the host filesystem.
Patch Information
No official patch has been released. The maintainer was notified through the upstream GitHub issue but has not responded. Because the project uses a rolling release model, organizations running this codebase must apply remediation in their own fork or remove the application from production until upstream fixes are published. Refer to the project repository for the latest commit state.
Workarounds
- Implement server-side validation of the stimg argument: enforce an allowlist of image extensions, validate magic bytes, and reject any file whose detected type is not an image.
- Store uploaded files outside the web root and serve them through a controller that sets a fixed Content-Type and Content-Disposition.
- Rename uploaded files to randomized identifiers without preserving the attacker-controlled extension.
- Place a web application firewall in front of the application to block multipart uploads containing script content types.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
