The vulnerability CVE-2026-7238 affects code-projects Online Music Site 1.0 and is located in the /Administrator/PHP/AdminUpdateAlbum.php file. The issue arises from improper validation of the txtimage parameter, enabling unrestricted file upload. This can be exploited remotely by an attacker with high privileges, potentially allowing them to upload malicious files to the server. The CVSS 4.0 base score is 5.1 (medium), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No official patch or remediation level has been disclosed by the vendor, and the product is not a cloud service.

Successful exploitation allows an attacker with high privileges to upload arbitrary files to the server, which may lead to further compromise depending on the uploaded content. The impact is rated medium with limited confidentiality, integrity, and availability effects. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable administrative interface and monitor for unauthorized file uploads. Avoid exposing the /Administrator/PHP/AdminUpdateAlbum.php endpoint to untrusted users.