CVE-2026-108973: Unrestricted Upload in SourceCodester Contact Tracing System

CVE-2026-108973 is an unrestricted file upload vulnerability affecting SourceCodester Contact Tracing System 1.0. The issue arises from improper validation or sanitization of the argument img/id in the move_uploaded_file function in /classes/Users.php?f=save, allowing remote attackers to upload arbitrary files. This vulnerability is remotely exploitable and has been publicly disclosed, but no known exploits are currently reported in the wild.

Successful exploitation could allow an attacker to upload arbitrary files to the server, potentially leading to remote code execution or other unauthorized actions depending on the server configuration and file handling. The CVSS score of 6.9 indicates a medium severity impact with network attack vector, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts.

No official patch or remediation guidance is currently provided. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting file upload permissions, validating and sanitizing uploaded files, and implementing server-side controls to limit file types and execution rights are recommended as temporary mitigations.