The vulnerability CVE-2026-10172 affects Bdtask Multi-Store Inventory Management System 1.0. It is caused by insufficient validation in the Upload function located in application/modules/dashboard/controllers/Module.php, specifically in the handling of the module argument. This flaw permits unrestricted file uploads from remote attackers, potentially allowing them to upload malicious files to the system. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No vendor advisory or patch information is currently available, and the exploit has been publicly disclosed.

Successful exploitation of this vulnerability could allow an attacker to upload arbitrary files to the affected system remotely. This may lead to unauthorized file storage, potential execution of malicious code, or other impacts depending on the uploaded file and system configuration. The CVSS score of 5.3 reflects a moderate impact with low complexity and no required user interaction. There is no indication of known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable upload functionality, implement additional validation or filtering on uploaded files, and monitor for suspicious activity related to file uploads. Avoid exposing the upload endpoint publicly if possible.