The vulnerability CVE-2026-5546 affects Campcodes Complete Online Learning Management System 1.0. It arises from insufficient restrictions on file uploads in the add_lesson function of the Crud_model.php file, allowing an attacker to upload arbitrary files remotely. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized file storage or execution depending on the server configuration. The impact is rated medium based on CVSS 4.0 with limited confidentiality, integrity, and availability impact. No known exploits in the wild have been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting file upload permissions, implementing additional validation or filtering on uploaded files, and monitoring for suspicious activity related to file uploads in the affected system. No official or temporary fixes have been documented.