CVE-2026-77681: Unrestricted Upload in CodeAstro Online Job Portal

The vulnerability in CodeAstro Online Job Portal 1.0 involves an unrestricted file upload via manipulation of the Name parameter in the /users/update-profile.php endpoint. This flaw allows an attacker with some privileges (PR:L) to upload arbitrary files remotely without user interaction, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, and no user interaction required. No official patch or fix details are provided in the available data.

Successful exploitation could allow an attacker to upload arbitrary files, potentially leading to limited confidentiality, integrity, and availability impacts on the affected system. The CVSS score of 6.3 reflects these moderate impacts. However, no evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the vulnerable endpoint and validate or sanitize inputs to prevent unauthorized file uploads.