[ CVE-2026-73328 · Published 3 Nov 2026 ]
Vulnerability in volmarg personal-management-system
CVSS 7.2
EPSS <1%No fix listed yet
[ Description ]Official description
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/Volmarg/personal-management-system
- github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileA…
- github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/Fil…
- github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/Fil…
- github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/Fil…
- github.com/Volmarg/personal-management-system/issues/167
- www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestric…