CVE-2026-1445 identifies an unrestricted file upload vulnerability in the iJason-Liu Books_Manager software, specifically in the upload_bookCover.php controller. The vulnerability arises from insufficient validation or restrictions on the 'book_cover' parameter, allowing an attacker with high privileges to upload arbitrary files remotely. The vulnerability affects the code base up to commit 298ba736387ca37810466349af13a0fdf828e99c. Due to the rolling release model of the product, pinpointing exact affected versions is challenging. The CVSS 4.0 score is 5.1 (medium), reflecting network attack vector, low complexity, no user interaction, but requiring privileges. The impact on confidentiality, integrity, and availability is limited but non-negligible, as unrestricted uploads could enable attackers to place malicious files on the server, potentially leading to code execution or data manipulation if combined with other vulnerabilities. No public exploits are currently known, but the vulnerability has been disclosed, increasing the risk of future exploitation. The lack of patch links suggests that users must monitor vendor updates closely or implement compensating controls.

For European organizations using iJason-Liu Books_Manager, this vulnerability poses a moderate risk. Unrestricted upload can allow attackers to place malicious files on servers, potentially leading to web shell deployment, data tampering, or service disruption. Although exploitation requires high privileges, insider threats or compromised accounts could leverage this flaw to escalate attacks. The impact on confidentiality includes possible exposure or alteration of sensitive book management data. Integrity could be compromised by unauthorized file modifications, and availability might be affected if malicious uploads disrupt service operations. Organizations in sectors relying on this software for digital content management, such as publishing, education, or libraries, could face operational disruptions and reputational damage. The rolling release model complicates patch management, increasing the window of exposure.

European organizations should implement strict access controls to limit who can upload files, ensuring only trusted, authenticated users with necessary privileges can perform uploads. Employing web application firewalls (WAFs) to detect and block suspicious upload attempts can provide an additional layer of defense. Validate and sanitize all uploaded files rigorously, restricting allowed file types, sizes, and content to prevent malicious payloads. Monitor server directories for unexpected or unauthorized files and maintain comprehensive logging to detect anomalous activities. Since no official patches are currently linked, organizations should engage with the vendor for timely updates and consider temporary disabling of the upload feature if feasible. Regularly update and audit user privileges to minimize the risk of privilege abuse. Conduct penetration testing focused on file upload functionalities to identify and remediate weaknesses proactively.