CVE-2026-77681: Unrestricted Upload in CodeAstro Online Job Portal

The vulnerability CVE-2026-77681 affects CodeAstro Online Job Portal 1.0. It arises from improper validation of the Name argument in the /users/update-profile.php file, allowing an attacker to perform unrestricted file uploads remotely. This flaw could enable an attacker to upload malicious files to the server, potentially leading to further compromise. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Exploit code is publicly available, but no active exploitation has been reported.

An attacker can remotely upload arbitrary files to the affected server via the vulnerable parameter, potentially leading to unauthorized code execution or other malicious activities. The vulnerability requires no user interaction and low attack complexity, increasing the risk of exploitation. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and validate inputs on the server side to mitigate exploitation risk.