CVE-2026-108922: Unrestricted Upload in KusalkaSilva Learning-Management-System

This vulnerability in KusalkaSilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2 involves the getimagesize function in upload_save.php. By manipulating the uploaded_file/image argument, an attacker can bypass restrictions and upload arbitrary files remotely. The product's rolling release model means no fixed version or patch is currently available. The vendor has not responded to the issue report, and a public exploit exists.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized file storage or execution on the system. This could facilitate further attacks depending on the uploaded content. The CVSS 4.0 score of 5.3 indicates a medium impact with network attack vector, low complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or fix is available, users should consider implementing temporary controls such as restricting file upload permissions or disabling uploads until a fix is released.