CVE-2026-0643: projectworlds House Rental and Property Listing: unrestricted file upload in register.php
CVE-2026-0643 is a critical unrestricted file upload flaw in the Signup component of projectworlds House Rental and Property Listing 1.0, reachable through the register.php file. The record reports remote exploitation is possible and that an exploit has been published, though CISA KEV does not list it. No fixed version is recorded, so defenders should restrict and inspect the upload path until the vendor or maintainer provides guidance.
Overview
The record describes a flaw in the Signup component of projectworlds House Rental and Property Listing 1.0. The issue is located in the file /app/register.php, reached through the action=reg request, where manipulation of the image argument leads to unrestricted upload, classified as CWE-434. The information comes from a VulDB entry and NVD.
Impact
- An unauthenticated remote party may be able to upload files that the application does not adequately restrict, according to the record's remote and no-privilege-required attributes.
- NVD assigns a base score of 9.8 (critical) with high confidentiality, integrity and availability impact. Other scores in the record, from VulDB and the CNA, range from 5.5 to 7.5 depending on the CVSS version used.
- The SSVC data in the record marks the technical impact as partial, which is a narrower assessment than the NVD base score alone suggests.
Affected products and versions
- Projectworlds House Rental and Property Listing, version 1.0.
- Projectworlds House Rental And Property Listing Project, version 1.0.
- No other versions are listed in the record. Whether later or earlier releases are affected is unknown.
Exploitation status
The record states that an exploit has been published and may be used, and the GitHub issue cited in the references is tagged as an exploit. SSVC reports exploitation as proof-of-concept. CISA KEV does not list this CVE, so no active exploitation is confirmed in the sources consulted.
Remediation and mitigation
- No fixed version is recorded. The absence of a fix in this record does not mean none exists; check the vendor or project for updates.
- If no update is available, restrict access to the registration functionality, for example by limiting it to trusted networks or temporarily disabling public sign-up.
- Enforce server-side validation of file type and content, use an allowlist of extensions, rename uploaded files, and store uploads outside the web root with execution disabled.
- Review existing upload directories for unexpected files and remove any that cannot be justified.
Detection guidance
- Review web server and application logs for requests to the registration endpoint that include multipart file uploads, especially from unexpected sources.
- Monitor upload directories for new files with executable or unexpected extensions, and alert on any such file being served or executed.
- Track changes to the application's upload configuration and file system permissions.
Limitations of the available information
- The record does not describe the exact validation logic or the precise conditions required for exploitation.
- No fixed version, vendor advisory or patch is included in the sources consulted.
- The scores differ across providers and CVSS versions, so severity should be read in context.
- The EPSS entry carries a date that is later than the publication date, and this has not been independently verified.
- The information has not been independently reproduced.
Frequently asked questions
What is CVE-2026-0643?
It is a critical unrestricted file upload flaw in the Signup component of projectworlds House Rental and Property Listing 1.0, located in register.php.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, so no active exploitation is confirmed in the sources consulted. The record does state that an exploit has been published.
Is there a fixed version?
No fixed version is recorded. Check the vendor or project for updates and apply mitigations in the meantime.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.