The vulnerability CVE-2026-10172 affects Bdtask Multi-Store Inventory Management System 1.0. It is caused by insufficient validation in the Upload function located in application/modules/dashboard/controllers/Module.php. Specifically, manipulation of the 'module' argument allows an attacker to perform unrestricted file uploads remotely. This can potentially lead to unauthorized file storage on the server. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been published as of the data provided.

Successful exploitation allows remote attackers to upload files without restriction, which could lead to unauthorized file storage on the affected system. The CVSS score of 5.3 reflects a medium severity impact with limited confidentiality, integrity, and availability consequences. No known exploits are currently active in the wild, reducing immediate risk but the public availability of the exploit code increases potential threat.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for any forthcoming fixes. Until a patch is released, consider implementing network-level controls to restrict access to the affected upload functionality and validate or sanitize inputs related to file uploads where possible.