The vulnerability CVE-2026-78202 affects itsourcecode Payroll System version 1.0. It arises from insufficient validation of the 'img' argument in the save_settings function within admin_class.php, enabling unrestricted file upload. This flaw can be exploited remotely without any privileges or user interaction. The exploit code has been publicly disclosed, increasing the risk of exploitation. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to upload arbitrary files to the server. This could lead to unauthorized code execution or other malicious activities depending on the uploaded file and server configuration. The vulnerability has a medium severity rating with a CVSS score of 6.9. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality, implement web application firewall rules to detect and block malicious upload attempts, and monitor for suspicious activity related to file uploads. Avoid deploying the affected version in production environments if possible.