CVE-2026-119620

HighCVSS 7.3/10Last modified Oct 30, 2026

Description

A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1196254.3The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to CVE-2026-1196274.3The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility o CVE-2026-119638.1The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and CVE-2026-1196368.8Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.2 CVE-2026-119649.1The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook noti CVE-2026-1196416.5** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another CVE-2026-1196445.4Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pi CVE-2026-1196456.5ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read document CVE-2026-1196464.3Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data be CVE-2026-1196474.3RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authentic CVE-2026-1196484.3Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts CVE-2026-1196497.1Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that al