CVE-2026-14777 describes an unrestricted file upload vulnerability in SourceCodester Onlne Examination & Learning Management System 1.0, specifically in the /announcements.php functionality. An attacker with low privileges can remotely exploit this flaw without user interaction, potentially uploading arbitrary files. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor advisory or patch information available at this time.

The vulnerability allows remote attackers with low privileges to upload files without restriction through the /announcements.php endpoint. This could lead to unauthorized file uploads, which may be leveraged for further attacks such as remote code execution or defacement, depending on the server configuration and file handling. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the /announcements.php file and monitor for suspicious upload activity. Implement additional file upload validation and filtering as a temporary measure.