CVE-2026-91005: Faculty Clearance System RCE Vulnerability

CVE-2026-91005 Overview

CVE-2026-91005 is an unrestricted file upload vulnerability affecting SourceCodester Online Faculty Clearance System 1.0. The flaw resides in the move_uploaded_file function within production/edit_picture.php, part of the Profile Picture Upload component. An authenticated attacker can manipulate the File argument to upload arbitrary file types to the server. The exploit is publicly available and can be triggered remotely over the network. The weakness is classified as [CWE-284] Improper Access Control.

Critical Impact
Authenticated remote attackers can upload arbitrary files through the Profile Picture Upload feature, potentially leading to persistence or further compromise of the web application.

Affected Products

SourceCodester Online Faculty Clearance System 1.0
Component: Profile Picture Upload (production/edit_picture.php)
Vulnerable function: move_uploaded_file

Discovery Timeline

2026-09-15 - CVE-2026-91005 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91005

Vulnerability Analysis

The vulnerability exists in the profile picture upload workflow of the Online Faculty Clearance System. The edit_picture.php script invokes PHP's move_uploaded_file on user-supplied input without validating the file type, extension, or content. An attacker with low-privilege access can submit a crafted multipart form request containing a server-executable file, such as a PHP script, disguised or renamed as a profile picture. Once written to a web-accessible directory, the file can be requested by URL to trigger execution within the application context. The public availability of exploit details lowers the barrier for opportunistic abuse against exposed instances.

Root Cause

The root cause is missing access control and input validation on the file upload handler. The application accepts the uploaded file argument, passes it to move_uploaded_file, and stores it under a predictable path without MIME verification, extension allowlisting, or content inspection. This maps directly to [CWE-284] Improper Access Control and is consistent with unrestricted upload weaknesses commonly seen in PHP applications.

Attack Vector

Exploitation requires network access to the application and a valid low-privileged account that can reach the profile picture edit interface. The attacker submits a POST request to production/edit_picture.php containing a malicious file in the File parameter. Because no server-side restrictions filter dangerous extensions, the file is written to disk and remains accessible through the web server. See the GitHub Issue Report and VulDB CVE-2026-91005 for reproduction details.

Detection Methods for CVE-2026-91005

Indicators of Compromise

Presence of unexpected .php, .phtml, .phar, or other executable files in profile picture upload directories.
HTTP POST requests to production/edit_picture.php with non-image Content-Type values or oversized payloads.
Web server access logs showing subsequent GET requests to newly created files inside the profile picture directory.

Detection Strategies

Monitor web application logs for requests to edit_picture.php originating from low-privileged accounts followed by direct file retrieval attempts.
Perform file integrity monitoring on the upload directory to identify additions of files with non-image extensions.
Inspect stored files with MIME sniffing or antivirus scanning to detect scripts masquerading as images.

Monitoring Recommendations

Alert on any web shell signatures or PHP code execution attempts originating from upload directories.
Correlate authentication events with upload activity to identify accounts abusing the profile picture feature.
Enable centralized logging of web server, PHP, and application logs for retrospective analysis.

How to Mitigate CVE-2026-91005

Immediate Actions Required

Restrict network exposure of the Online Faculty Clearance System until validation controls are in place.
Disable or gate the profile picture upload feature for untrusted accounts.
Audit the upload directory for unauthorized files and remove any that are not legitimate images.

Patch Information

No vendor patch is referenced in the available advisories for SourceCodester Online Faculty Clearance System 1.0. Consult the SourceCodester Blog and the VulDB Vulnerability #403588 entry for updates. Operators should apply compensating controls until a fix is published.

Workarounds

Implement server-side allowlisting of image extensions (.jpg, .jpeg, .png, .gif) and validate MIME type and magic bytes before calling move_uploaded_file.
Store uploaded files outside the web root or in a directory where the web server does not execute scripts.
Rename uploaded files to random identifiers and strip original extensions to prevent script execution.
Enforce authentication and session integrity checks on the edit_picture.php endpoint.

bash

# Example Apache configuration to prevent script execution in the uploads directory
<Directory "/var/www/faculty_clearance/production/uploads">
    php_flag engine off
    AddType text/plain .php .phtml .phar .pl .py .cgi
    Options -ExecCGI
</Directory>