This vulnerability affects SourceCodester Syllabus-Aligned Learning Management and Examination System version 1.0. An unrestricted file upload issue exists in the upload_files.php file, permitting remote attackers to upload files without adequate validation or restrictions. This could potentially allow attackers to upload malicious files to the system. The vulnerability has been assigned CVE-2026-14698 and carries a CVSS 4.0 score of 5.3, indicating medium severity. No official patch or vendor advisory is currently available, and the exploit has been publicly disclosed.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system, which could lead to further compromise depending on how the uploaded files are handled or executed. The exact impact depends on the system's configuration and usage of the uploaded files. No known active exploitation in the wild has been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement manual controls such as restricting file upload types, validating file contents, and limiting upload permissions where possible to reduce risk.