The vulnerability CVE-2026-19987 affects SourceCodester Best Employee Management System version 1.0. It arises from the exposure of information through directory listing in the /assets/uploadImage/Profile/ path. This allows an unauthenticated remote attacker to enumerate files within that directory, potentially disclosing sensitive data. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges required, no user interaction, and low impact on confidentiality. No official patch or remediation guidance is currently available.

An attacker can remotely access directory listings in the specified path, potentially exposing sensitive files or information stored in the /assets/uploadImage/Profile/ directory. This could lead to information disclosure but does not indicate direct code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /assets/uploadImage/Profile/ directory by disabling directory listing on the web server or applying appropriate access controls to prevent unauthorized directory enumeration.