This vulnerability involves an unrestricted file upload flaw in the Profile Picture Handler of the ProjectsAndPrograms School Management System up to commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The flaw is triggered by manipulation of the File argument in /admin_panel/settings.php, allowing remote attackers with limited privileges to upload arbitrary files. The system's rolling release approach means versioning details for affected or fixed releases are not specified. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with limited privileges to upload arbitrary files remotely, potentially leading to further compromise depending on the file type and server configuration. The impact on confidentiality, integrity, and availability is rated as low to limited. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product follows a rolling release model and no official fix or workaround is currently documented, users should monitor vendor communications for updates. Until a fix is available, restricting access to the vulnerable component and validating uploaded files may reduce risk.