CVE-2026-107356
8.8 HIGHPublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2014-125138PoC
- CRITICALCVE-2023-54405PoC
- HIGHCVE-2025-15700
- UNSCOREDCVE-2025-68391
- HIGHCVE-2026-100389
- MEDIUMCVE-2026-101071PoC
- HIGHCVE-2026-102130PoC
- MEDIUMCVE-2026-102137PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.