CVE-2026-108974: Unrestricted Upload in SourceCodester E-Learning System

The vulnerability in SourceCodester E-Learning System 1.0 exists in the save_users function within /classes/Users.php. By manipulating the img parameter, an attacker can perform unrestricted file uploads remotely. This could potentially allow the attacker to upload malicious files to the server. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed with exploit code available, but no active exploitation has been reported.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system, which could lead to further compromise depending on the server configuration and file handling. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS vector indicates low confidentiality, integrity, and availability impacts, suggesting limited direct damage without additional chained exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict file upload permissions and validate or sanitize input parameters related to file uploads as a temporary mitigation.