CVE-2026-14776: SourceCodester LMS File Upload Bypass

CVE-2026-14776 Overview

CVE-2026-14776 is an unrestricted file upload vulnerability affecting SourceCodester Online Examination & Learning Management System 1.0. The flaw resides in the pathinfo function within /upload_files.php, where filename extension handling fails to properly restrict uploaded file types. Remote attackers with low-privilege authentication can exploit this weakness to upload arbitrary files, including server-side scripts. Public exploit documentation has been released, increasing the likelihood of opportunistic attacks against exposed instances. The vulnerability is classified under [CWE-284] (Improper Access Control) and impacts confidentiality, integrity, and availability at a limited scope.

Critical Impact
Authenticated remote attackers can upload arbitrary files via the filename extension bypass, enabling potential remote code execution on affected SourceCodester OE-LMS 1.0 deployments.

Affected Products

SourceCodester Online Examination & Learning Management System 1.0
Component: Filename Extension handling in /upload_files.php
Vulnerable function: pathinfo

Discovery Timeline

2026-07-05 - CVE-2026-14776 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14776

Vulnerability Analysis

The vulnerability exists in the file upload handler at /upload_files.php. The application uses PHP's pathinfo function to determine and validate the extension of uploaded files. Because pathinfo returns only the string after the final dot in a filename, attackers can craft filenames that pass client-side or superficial server-side checks while still executing as server-side code.

An attacker with valid low-privilege credentials submits a multipart form request containing a file with an attacker-controlled extension. The application stores the file in a web-accessible directory without enforcing a strict allowlist of permitted MIME types or extensions. Requesting the uploaded file through the web server triggers execution in the PHP interpreter, resulting in remote code execution in the context of the web server user.

Root Cause

The root cause is improper access control [CWE-284] in the extension validation logic. Relying on pathinfo alone provides no defense against double extensions, null byte tricks, case variations, or executable script types that the web server is configured to interpret. The upload directory also lacks execution restrictions.

Attack Vector

Exploitation requires network access to the application and low-privilege authenticated access. The attacker submits a POST request to /upload_files.php containing a script payload with a filename designed to bypass extension checks. Once uploaded, the attacker requests the file URL directly, causing the web server to execute the payload. Public proof-of-concept documentation is available in the referenced GitHub RCE Exploit Documentation.

Detection Methods for CVE-2026-14776

Indicators of Compromise

Unexpected .php, .phtml, or .phar files appearing in the upload directory used by OE-LMS
POST requests to /upload_files.php followed shortly by GET requests to newly created files in the same directory
Web server process spawning shell interpreters (/bin/sh, bash, cmd.exe) after file upload activity
Outbound network connections from the web server to unfamiliar IP addresses following upload events

Detection Strategies

Monitor web server access logs for POST requests to /upload_files.php from authenticated sessions, correlating uploaded filenames with subsequent GET requests
Deploy file integrity monitoring on the OE-LMS upload directories to alert on creation of executable script files
Inspect uploaded file content with server-side scanning to identify PHP tags or obfuscated payloads regardless of declared extension

Monitoring Recommendations

Enable verbose logging on the web application and forward logs to a centralized SIEM for correlation
Alert on web server processes executing operating system binaries such as id, whoami, wget, or curl
Track authentication events preceding upload activity to identify compromised low-privilege accounts

How to Mitigate CVE-2026-14776

Immediate Actions Required

Restrict network access to OE-LMS 1.0 instances until a vendor patch is available, using firewall rules or VPN gating
Disable the /upload_files.php endpoint if the file upload feature is not required for business operations
Configure the web server to prevent execution of scripts within upload directories using .htaccess rules or equivalent server configuration
Audit existing files in upload directories and remove any suspicious script files

Patch Information

No official vendor patch has been published for SourceCodester Online Examination & Learning Management System 1.0 at the time of this writing. Monitor SourceCodester Security Resources and the VulDB CVE-2026-14776 Page for updates. Organizations should apply compensating controls until a fix is released.

Workarounds

Implement a strict server-side allowlist of permitted file extensions and validate MIME types against file magic bytes rather than declared extensions
Rename uploaded files to randomized identifiers without preserving user-supplied extensions
Store uploaded files outside the web root and serve them through a controlled proxy script that sets appropriate Content-Type and Content-Disposition headers
Deploy a web application firewall with rules to block requests containing multiple extensions or script tags in uploaded content

bash

# Apache configuration example: disable script execution in uploads directory
<Directory "/var/www/oe-lms/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar .php3 .php4 .php5
    Options -ExecCGI
    RemoveHandler .php .phtml .phar
</Directory>