Volmarg Personal Management System File Upload RCE via /upload/send/
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload flaw in the /upload/send/ endpoint. An authenticated user can upload PHP files into the web root and run code as the web server user, because the upload accepts base64 content with a .php file name (CWE-434).
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Volmarg Personal Management System.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Timeline
- 2026-11-03 Threatist record created from CVE-2026-73328
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → LOW
- 2026-11-03 Alias added: GHSA-m4hj-g435-qj36
- 2026-11-05 Priority changed: LOW → MEDIUM
References
Other 6
- GitHub Issue #167
- https://github.com/Volmarg/personal-management-system
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67
More Volmarg vulnerabilities
- TI-2026-82224 OS command injection in Volmarg Personal Management System CVSS 4.0HIGH 8.6
- TI-2026-29273 Volmarg Personal Management System Path Traversal via get-file Endpoint CVSS 4.0HIGH 7.1
Sources
- CVE-2026-73328 · CVE Program
- CVE-2026-73328 · NVD
- FIRST EPSS
- GHSA-m4hj-g435-qj36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences