The vulnerability CVE-2026-7238 affects code-projects Online Music Site 1.0 and is located in the /Administrator/PHP/AdminUpdateAlbum.php file. The issue arises from improper validation of the txtimage parameter, enabling unrestricted file uploads. This can be exploited remotely by an attacker with high privileges and no user interaction is required. The CVSS 4.0 base score is 5.1, indicating a medium severity level. No patch or official remediation has been published as of now.

Successful exploitation allows an attacker with high privileges to upload arbitrary files to the server, potentially leading to further compromise depending on the uploaded content. The vulnerability does not require user interaction and can be triggered remotely. However, the impact is limited by the requirement for high privileges, reducing the overall risk to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected administrative functionality to trusted users only and monitor for suspicious file uploads. Avoid exposing the vulnerable endpoint to untrusted networks.