The vulnerability CVE-2026-90519 affects PHPGurukul Bank Locker Management System 1.0. It is caused by insufficient validation of the addressproof parameter in the add-locker-form.php script, enabling unrestricted file uploads. This can be exploited remotely by an attacker with low privileges and no user interaction required. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction. Public exploit code is available, but there are no known reports of active exploitation in the wild.

An attacker can remotely upload arbitrary files to the server, potentially leading to further compromise such as code execution or data manipulation. The vulnerability requires low privileges and no user interaction, increasing the risk. However, the overall impact is rated medium due to limited scope and complexity.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the vulnerable upload functionality and implement manual validation or filtering of uploaded files to mitigate risk.