CVE-2026-15677: Online Job Portal 1.0 RCE Vulnerability

CVE-2026-15677 Overview

CVE-2026-15677 is an unrestricted file upload vulnerability in code-projects Online Job Portal 1.0. The flaw resides in the /JobSeekerInsert.php endpoint, where the txtFile parameter fails to enforce file type or content restrictions. Attackers can send crafted HTTP requests over the network without authentication to upload arbitrary files. A public exploit exists, increasing the likelihood of opportunistic attacks against exposed instances. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
Remote, unauthenticated attackers can upload arbitrary files through the txtFile argument in JobSeekerInsert.php, potentially leading to web shell deployment and further compromise of the hosting environment.

Affected Products

code-projects Online Job Portal 1.0
Deployments using the /JobSeekerInsert.php upload handler
Any web server hosting the vulnerable PHP application

Discovery Timeline

2026-07-14 - CVE-2026-15677 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15677

Vulnerability Analysis

The vulnerability exists in the file upload handler inside /JobSeekerInsert.php. The txtFile parameter accepts user-supplied file data without validating extension, MIME type, or content signatures. This allows an attacker to submit executable server-side scripts, such as PHP files, disguised as legitimate uploads. Because the application runs on a PHP interpreter, uploaded scripts placed in web-accessible directories can be requested and executed. The result is remote code execution in the context of the web server process.

The attack requires no authentication and no user interaction. An exploit for the flaw has been made available publicly, meaning proof-of-concept payloads are accessible to opportunistic actors scanning for vulnerable job portal instances.

Root Cause

The root cause is missing access control and input validation on file uploads [CWE-284]. JobSeekerInsert.php treats the txtFile input as trusted, writing it to disk without filtering. There is no allowlist of permitted extensions, no verification of file magic bytes, and no isolation of the upload directory from PHP execution.

Attack Vector

An attacker crafts a multipart HTTP POST request to /JobSeekerInsert.php containing a malicious PHP file supplied through the txtFile field. Once uploaded, the attacker requests the file directly from the web server to trigger execution. Successful exploitation yields command execution, data theft, or lateral movement inside the hosting infrastructure.

See the GitHub Issue Discussion and VulDB CVE-2026-15677 entry for additional technical context.

Detection Methods for CVE-2026-15677

Indicators of Compromise

HTTP POST requests to /JobSeekerInsert.php containing multipart form data with the txtFile field referencing executable extensions such as .php, .phtml, or .phar.
Unexpected files with server-executable extensions appearing in upload directories used by the Online Job Portal application.
Outbound network connections initiated by the web server process shortly after uploads to JobSeekerInsert.php.

Detection Strategies

Inspect web server access logs for POST requests to /JobSeekerInsert.php followed by GET requests to newly created files under the upload path.
Deploy a web application firewall rule that blocks uploads via txtFile when the file extension or MIME type is not in an approved list.
Monitor the PHP-FPM or Apache process tree for child processes spawning shells (sh, bash, cmd.exe) after a file upload event.

Monitoring Recommendations

Enable file integrity monitoring on the web root and upload directories to alert on new PHP files.
Correlate HTTP request logs with process creation telemetry from the hosting server to identify web shell activity.
Track authentication-less requests to upload endpoints and alert on volume anomalies that suggest scanning.

How to Mitigate CVE-2026-15677

Immediate Actions Required

Restrict network exposure of the Online Job Portal application, placing it behind authenticated access controls or removing it from the public internet until remediated.
Disable PHP execution in any directory that receives user-uploaded files by configuring the web server accordingly.
Audit the upload directory for unexpected files and remove any suspected web shells.

Patch Information

No vendor patch has been published for CVE-2026-15677 at the time of NVD publication. Consult the Code Projects Resource Hub and the VulDB Vulnerability #378167 entry for updated remediation guidance.

Workarounds

Implement server-side allowlisting in JobSeekerInsert.php so only expected file types (for example, .pdf, .doc, .docx) are accepted.
Rename uploaded files to random identifiers and store them outside the web root, serving them through a controlled download handler.
Deploy a web application firewall rule that inspects the txtFile parameter and blocks executable content signatures.

bash

# Apache configuration example: disable PHP execution in the uploads directory
<Directory "/var/www/OnlineJobPortal/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>