The vulnerability CVE-2026-5546 affects Campcodes Complete Online Learning Management System 1.0. It stems from insufficient restrictions on file uploads in the add_lesson function within the Crud_model.php file, allowing an attacker to upload arbitrary files remotely. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed with an exploit available, but no official fix or mitigation has been documented.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized file placement on the server. This could enable further attacks depending on the uploaded file's nature, but specific impacts beyond unrestricted upload are not detailed in the available data.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider implementing manual controls such as restricting upload permissions, validating file types, or isolating the affected functionality to reduce risk.