CVE-2026-108975: Unrestricted Upload in SourceCodester Library Management System

This vulnerability affects SourceCodester Library Management System 1.0 and is caused by insufficient validation or restrictions on the file upload functionality in the admin/add_admin.php file, specifically in the move_uploaded_file function. An attacker can manipulate the 'image' argument to upload files without restriction, potentially leading to remote code execution or other impacts depending on the uploaded file. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9 (medium severity). Public exploit code is available, but no vendor patch or fix has been identified.

Successful exploitation allows an unauthenticated remote attacker to upload arbitrary files to the server, which can lead to unauthorized code execution, system compromise, or data breach depending on the server configuration and file handling. The vulnerability has a medium severity rating with a CVSS score of 6.9, indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict file upload permissions, implement strict validation on uploaded files, and monitor for suspicious upload activity. Consider disabling or restricting the vulnerable upload functionality if possible.