Read the docs
TI-2026-01833 Aliases CVE-2026-2184GHSA-g6qp-w7v4-4fg9

Great Developers Certificate Generation System csv.php os command injection

Priority HIGH 70CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unknown code of the file /restructured/csv.php. The manipulation of the argument photo results in os command injection. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The code repository of the project has not been active for many years.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.10529 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Great DevelopersCertificate Generation System97171bb0e5e22e52eacf4e4fa81773e5f3cffb73—No fix listedCNA
  • Certificate Generation System VendorGreat Developers Affected 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:greatdevelopers:certificate:*:*:*:*:*:*:*:*up to 2017-10-16VulnerableGreat Developers
  • cpe:2.3:a:greatdevelopers:certificate:*:*:*:*:*:*:*:* Versions up to 2017-10-16 Vulnerable ·Great Developers

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2184
  2. 2026-10-03 Alias added: GHSA-g6qp-w7v4-4fg9

References

Exploit 1

  • TI-2026-01832 Great Developers Certificate Generation System csv.php unrestricted upload CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences