CVE Intelligence
Analysis AI-assisted

CVE-2026-2133: code-projects Online Music Site 1.0 Unrestricted File Upload via AdminUpdateCategory.php

CVE-2026-2133 is an unrestricted file upload weakness in code-projects Online Music Site 1.0, reachable through the txtimage argument of /Administrator/PHP/AdminUpdateCategory.php. NVD rates it 9.8 (Critical) under CVSS 3.1, and the record states the attack can be carried out remotely. The record notes that a public exploit reference exists, but CISA KEV does not list this CVE and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2133 describes a weakness in code-projects Online Music Site 1.0. The record places it in the file /Administrator/PHP/AdminUpdateCategory.php, where manipulation of the txtimage argument allows unrestricted upload. The CNA is VulDB, and the CWE assigned is CWE-284 (Improper Access Control). The description and the CWE label do not fully match, so the root cause should be confirmed against the vendor or VulDB entry.

Impact

  • NVD scores the issue 9.8 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network access, no privileges and no user interaction required.
  • Unrestricted upload in a web application can, depending on server configuration, allow an attacker to place files on the server. The record does not state which file types are accepted or what the server does with them, so the final impact is unknown.
  • VulDB also provides other scores (7.3 under 3.1, 5.5 under 4.0, 7.5 under 2.0) that differ from the NVD figure.

Affected products and versions

  • The record lists Fabian Online Music Site, version 1.0. The description refers to code-projects Online Music Site 1.0. The vendor and product naming should be reconciled before inventory matching.
  • No fixed version is listed in the record. This does not mean no fix exists; the status of a fix is unknown.

Exploitation status

  • The record states that an exploit has been made available to the public and could be used for attacks. A reference tagged as exploit material is present in the record. This analysis does not reproduce any exploit details.
  • CISA KEV lists this CVE as not listed in the record. No confirmed active exploitation appears in the sources consulted.
  • The EPSS probability is 0.0047 with a percentile of 0.38926, as recorded in the data provided.

Remediation and mitigation

  • No vendor fix is identified in the record. Check the product source for updates, and if none exist, consider removing or replacing the application, since it is a small third-party project.
  • Restrict access to administrative paths such as /Administrator so they are not reachable from untrusted networks, using network controls or authentication in front of the application.
  • Enforce server-side validation of uploaded file types, sizes and content, and store uploads outside executable web directories.
  • Review existing upload directories for unexpected files and remove any that cannot be attributed to legitimate use.

Detection guidance

  • Review web server and application logs for requests to /Administrator/PHP/AdminUpdateCategory.php, especially from unexpected sources or with unusual parameter content.
  • Monitor file integrity in image and upload directories for newly created files that are executable or script-type.
  • Alert on requests to recently created files in upload locations that are then accessed directly by clients.

Limitations of the available information

  • The record does not identify the exact code path, the accepted file types, or the server behavior after upload.
  • No fixed version, vendor advisory or patch is listed.
  • The CWE assignment (CWE-284) differs in emphasis from the unrestricted upload description; the underlying weakness class is not confirmed by the record.
  • The EPSS date in the record is later than the publication date and should be verified against the source.
  • Affected version coverage beyond version 1.0 is unknown.

Frequently asked questions

Is CVE-2026-2133 being actively exploited?

CISA KEV does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been made available.

Is there an official fix for this vulnerability?

The record lists no fixed version. The fix status is unknown, so the product should be checked for updates or removed or replaced if no update exists.

What can administrators do now?

Restrict access to administrative paths, validate uploaded files on the server, store uploads outside executable directories, and review logs and upload folders for unexpected activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.