This vulnerability in tittuvarghese CollegeManagementSystem allows remote attackers to perform unrestricted file uploads via manipulation of the Student-Data-CSV argument in the Student Data Upload Endpoint (dashboard_page/forms/upload_student_data.php). The lack of proper validation or restrictions on uploaded files enables this attack vector. The product's rolling release model means no discrete version numbers are available to define affected or patched versions. The vendor has not issued any advisory or patch at the time of this report. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation allows remote attackers to upload arbitrary files without restriction, potentially leading to unauthorized file storage on the server. This could facilitate further attacks such as code execution or data manipulation depending on the server configuration and file handling. The impact is rated medium due to the potential for misuse but limited direct impact confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor for updates from the vendor. Until a fix is available, consider restricting access to the upload functionality, implementing manual validation of uploaded files, or disabling the upload feature if feasible.