CVE-2026-90519: Bank Locker Management System Auth Bypass

CVE-2026-90519 Overview

CVE-2026-90519 is an unrestricted file upload vulnerability in PHPGurukul Bank Locker Management System 1.0. The flaw resides in the /blms/banker/add-locker-form.php script, where the addressproof parameter accepts attacker-controlled file uploads without proper validation. An authenticated remote attacker with low privileges can abuse this parameter to upload arbitrary files to the web server. Public exploit details are available through VulDB and a related GitHub issue, increasing the likelihood of opportunistic abuse against internet-exposed instances. The weakness is categorized under CWE-284: Improper Access Control.

Critical Impact
Authenticated attackers can upload arbitrary files through the addressproof parameter, enabling potential webshell deployment and follow-on remote code execution on vulnerable PHPGurukul deployments.

Affected Products

PHPGurukul Bank Locker Management System 1.0
The /blms/banker/add-locker-form.php endpoint
The addressproof file upload parameter

Discovery Timeline

2026-09-13 - CVE-2026-90519 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90519

Vulnerability Analysis

The vulnerability affects the banker workflow used to register new locker records in PHPGurukul Bank Locker Management System 1.0. The add-locker-form.php handler processes an addressproof upload field intended to accept scanned identity documents. The application fails to enforce restrictions on file type, extension, or MIME content before storing the file inside the web root. Because the destination directory is served by the PHP interpreter, uploading a .php payload results in server-side execution when the file is requested. The issue falls under improper access control on resource handling ([CWE-284]).

Root Cause

The upload handler trusts client-supplied metadata and does not implement an allowlist of permitted extensions or content types. Server-side MIME sniffing, magic-byte inspection, and rename-to-random-identifier controls are absent. The combination of missing input validation and predictable storage location transforms a document upload feature into an arbitrary code execution primitive.

Attack Vector

An attacker authenticates to the banker portal with valid low-privileged credentials, then submits a crafted multipart request to /blms/banker/add-locker-form.php. The addressproof field carries a PHP payload disguised as a document. After upload, the attacker requests the resulting URL to trigger execution. Exploitation is remote and requires no user interaction beyond the attacker's own authenticated session.

No verified public proof-of-concept code has been reproduced for this article. See the GitHub Issue Discussion and the VulDB Vulnerability Details for the reporter's technical write-up.

Detection Methods for CVE-2026-90519

Indicators of Compromise

POST requests to /blms/banker/add-locker-form.php containing addressproof fields with executable extensions such as .php, .phtml, or .phar.
New files with server-executable extensions appearing in PHPGurukul upload directories after banker sessions.
Outbound connections initiated by the PHP-FPM or Apache worker process shortly after suspicious form submissions.

Detection Strategies

Inspect web server access logs for add-locker-form.php POST requests correlated with subsequent GET requests to newly created files in the same directory tree.
Enable file integrity monitoring on the application's upload and web root directories to alert on unexpected script creation.
Deploy web application firewall rules that reject multipart uploads whose declared filename ends in server-executable extensions.

Monitoring Recommendations

Alert on PHP interpreter processes spawning shell utilities such as sh, bash, nc, or curl from directories owned by the web server.
Monitor authentication logs for the banker role and flag account reuse from unexpected geographies or user agents.
Aggregate web server, PHP error, and host telemetry into a central analytics platform to correlate upload events with post-exploitation behavior.

How to Mitigate CVE-2026-90519

Immediate Actions Required

Restrict access to /blms/banker/ at the reverse proxy or firewall layer until the application is patched or replaced.
Rotate credentials for all banker accounts and audit recent locker registration activity for suspicious addressproof submissions.
Review the upload directory and remove any files with server-executable extensions that do not match legitimate document formats.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-90519. Refer to the PHP Gurukul Homepage and the VulDB CVE Report for future advisories. Organizations running Bank Locker Management System 1.0 in production should treat this software as unmaintained until the vendor issues a fix.

Workarounds

Configure the web server to disable PHP execution inside the upload directory using php_admin_flag engine off or an equivalent AddType override.
Front the application with a web application firewall rule that blocks multipart uploads containing PHP tags or executable extensions in the addressproof field.
Enforce server-side allowlisting by wrapping the upload handler with a validation shim that rejects any content type other than PDF, PNG, or JPEG and renames files to random identifiers.

bash

# Apache example: deny PHP execution inside the PHPGurukul upload directory
<Directory "/var/www/html/blms/banker/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|phps)$">
        Require all denied
    </FilesMatch>
</Directory>