CVE-2026-38751 is an arbitrary file upload vulnerability in OpenSTAManager version 2.10 and earlier, specifically within the module update functionality located at modules/aggiornamenti/upload_modules.php. The vulnerability allows an attacker with high privileges to upload malicious files, which can lead to complete compromise of the system's confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published as of the current information.

Successful exploitation of this vulnerability could allow an attacker with high privileges to upload arbitrary files to the server, potentially leading to full system compromise including data theft, data modification, or denial of service. The impact affects confidentiality, integrity, and availability at a high level. There are no known exploits in the wild, and no official patch or fix has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the module update functionality to trusted administrators only and monitor for any unauthorized file uploads. Avoid exposing the vulnerable functionality to untrusted networks or users.