CVE-2026-14776 identifies an unrestricted file upload vulnerability in SourceCodester Onlne Examination & Learning Management System 1.0. The issue exists in the pathinfo function of the /upload_files.php file, specifically in the handling of filename extensions, which allows attackers to bypass upload restrictions and upload arbitrary files remotely. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and the exploit code has been publicly disclosed.

Successful exploitation could allow an attacker with limited privileges to upload arbitrary files to the server, potentially leading to unauthorized code execution or further compromise depending on the server configuration and uploaded file usage. The vulnerability impacts confidentiality, integrity, and availability at a low level, consistent with the CVSS score of 5.3 (medium severity). No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the upload functionality to trusted users only and consider implementing additional file upload validation and filtering controls at the web server or application firewall level to mitigate risk.