Vulnerability · Published Oct 30, 2026 · Assigned by VulDB

CVE-2026-11962037954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload

High 7.3

In plain English

A high-severity unrestricted file upload in cak-filemanagement-system from 37954679. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
37954679	cak-filemanagement-system	5e6433246475e66462e1fea980688de96a049297

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-429059 | 37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload vdb-entry, technical-description
VDB-429059 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-119620 | CVE Analysis and Report third-party-advisory
Submit #1026375 | 37954679 cak-filemanagement-system 5e6433246475e66462e1fea980688de96a049297 Unrestricted Upload third-party-advisory
https://github.com/37954679/cak-filemanagement-system/issues/2 exploit, issue-tracking
https://github.com/37954679/cak-filemanagement-system/ product