dbcve.org
Improper Access ControlWeakness · CWE-284

CVE-2026-5670

MEDIUM · 6.3 CVSS v3.1 Published 2026-04-06
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
69/100
Remediation priority · Elevated
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

The Cyber-III Student-Management-System contains an unrestricted file upload vulnerability in the upload.php file within the AssignmentSection/submission directory. The move_uploaded_file function is being exploited without proper validation of the uploaded file, allowing remote attackers to upload malicious files (potentially PHP shells or other executables) to the server. This could lead to remote code execution, website defacement, or further network compromise.

MitigationImplement strict file upload controls including: whitelist of allowed file extensions/MIME types, validation of file content (magic bytes), storing uploads outside the web root or in non-executable directories, renaming uploaded files, and adding proper authentication/authorization checks before allowing uploads.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Cyber-III Student Management System installation
    Search your web server document root for files or directories containing 'Cyber-III', 'student', or 'management' in the path. Common locations include /var/www/html, /www, or C:\inetpub\wwwroot.
    Affected if The Cyber-III Student Management System is installed on the server.
  2. Locate the vulnerable upload.php file
    Navigate to the AssignmentSection/submission directory within the application root and verify the presence of upload.php. Check paths like: /path/to/application/AssignmentSection/submission/upload.php
    Affected if The file upload.php exists in AssignmentSection/submission directory.
  3. Verify upload functionality is web-accessible
    Attempt to access the upload.php via HTTP/HTTPS (e.g., https://yourdomain/AssignmentSection/submission/upload.php) or check web server configuration for routes exposing this directory.
    Affected if The upload.php is accessible via web requests without authentication restrictions.
  4. Examine upload.php for missing file validation
    Open upload.php and inspect the code for validation checks. Look for absence of: file extension whitelist, MIME type verification, content-type validation, or magic byte checking before move_uploaded_file() is called.
    Affected if The upload.php contains move_uploaded_file() calls without proper file type/extension/content validation.
  5. Check upload directory configuration
    Inspect the web server configuration or upload.php code to determine where uploaded files are stored. Verify if the destination directory is within the web root and if uploaded files retain executable extensions (e.g., .php, .exe).
    Affected if Uploaded files are saved in a web-accessible directory with their original extensions intact.

You are affected if the Cyber-III Student Management System is installed with the upload.php file present and accessible in AssignmentSection/submission without proper file validation controls.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Implement strict file upload controls including: whitelist of allowed file extensions/MIME types, validation of file content (magic bytes), storing uploads outside the web root or in non-executable directories, renaming uploaded files, and adding proper authentication/authorization checks before allowing uploads.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation6.0 h
  • Testing3.0 h
  • Review / QA3.0 h
15.0 hours of engineering $2,670
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-5670 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-5670 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data