CVE-2026-10807: Unrestricted Upload in mjperpinosa stumasy
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
AI Analysis
Technical Summary
This vulnerability in mjperpinosa stumasy allows remote attackers to perform unrestricted file uploads by manipulating the pr_profile_image argument in the change_profile_image.php script. The lack of restrictions on uploaded files could potentially allow an attacker to upload malicious files. The project operates on a rolling release basis, and no official fix or patch has been announced or made available. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not yet responded to the issue report, and no remediation level is specified.
Potential Impact
The vulnerability allows remote attackers to upload files without restriction, which could lead to unauthorized file uploads on the affected system. This may enable further attacks depending on the nature of the uploaded files, but specific impacts beyond the unrestricted upload are not detailed in the available information. There are no known exploits in the wild currently.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor the project for updates. Until a fix is released, consider implementing manual controls such as restricting file upload types or access to the affected functionality where possible.
CVE-2026-10807: Unrestricted Upload in mjperpinosa stumasy
Description
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in mjperpinosa stumasy allows remote attackers to perform unrestricted file uploads by manipulating the pr_profile_image argument in the change_profile_image.php script. The lack of restrictions on uploaded files could potentially allow an attacker to upload malicious files. The project operates on a rolling release basis, and no official fix or patch has been announced or made available. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not yet responded to the issue report, and no remediation level is specified.
Potential Impact
The vulnerability allows remote attackers to upload files without restriction, which could lead to unauthorized file uploads on the affected system. This may enable further attacks depending on the nature of the uploaded files, but specific impacts beyond the unrestricted upload are not detailed in the available information. There are no known exploits in the wild currently.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor the project for updates. Until a fix is released, consider implementing manual controls such as restricting file upload types or access to the affected functionality where possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-04T05:14:46.616Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a217eb6e29bf47b50a6c509
Added to database: 6/4/2026, 1:33:42 PM
Last enriched: 6/4/2026, 1:49:39 PM
Last updated: 6/5/2026, 5:02:00 AM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.