CVE Intelligence
Analysis AI-assisted

CVE-2026-2183: Greatdevelopers Certificate Generation System Unrestricted File Upload

A vulnerability classified as unrestricted upload of a file with dangerous type (CWE-434) was reported in the Great Developers Certificate Generation System, in an unspecified part of /restructured/csv.php. The NVD record assigns a CVSS 3.1 base score of 9.8 (critical) and describes remote exploitation as possible. No confirmed exploitation appears in the sources consulted, and no fixed version is listed.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The NVD and CNA records describe an unrestricted file upload issue (CWE-434) in the Great Developers Certificate Generation System, located in an unspecified part of /restructured/csv.php. The entry was submitted by VulDB as CNA, and the NVD assigns a CVSS 3.1 base score of 9.8.

Impact

  • According to the CVSS 3.1 vector in the record, confidentiality, integrity and availability impacts are rated High, with network attack vector and no privileges or user interaction required.
  • In general terms, an unrestricted upload can allow files that the application did not intend to accept to be stored. The record does not describe the concrete consequences for this product.

Affected products and versions

  • The record lists Greatdevelopers Certificate with versions up to and including ≤ 2017-10-16.
  • The description states that the product is affected up to a specific repository revision.
  • The product follows a rolling release model, and no version details for updated releases are provided.

Exploitation status

  • The KEV flag in the record is false. No confirmed active exploitation appears in the sources consulted.
  • The record includes a third-party reference tagged as exploit-related. This analysis did not verify its content, and its presence alone does not confirm exploitation in the wild.

Remediation and mitigation

  • No fixed version is listed in the record. This does not mean no fix exists, but the project repository is described as inactive for many years, so an official patch is uncertain.
  • Consider removing or isolating the affected component if it is not needed.
  • Restrict upload functionality to authenticated, trusted users and validate file type and content on the server side.
  • Store uploaded files outside the web root and without execute permissions.

Detection guidance

  • Review web server logs for unexpected requests to the affected file path and for unusual file uploads.
  • Monitor for newly created files with executable or script extensions in upload directories.

Limitations of the available information

  • The affected component within csv.php is described as unknown.
  • No fixed version, vendor patch, or precise version range beyond the date-based entry is provided.
  • The CVSS 4.0 and 2.0 scores from the CNA differ from the NVD CVSS 3.1 score, and the record does not indicate which reference is appropriate.
  • It is not known whether the project is still deployed anywhere.

Frequently asked questions

Is CVE-2026-2183 being actively exploited?

The KEV flag in the record is false, and no confirmed exploitation appears in the sources consulted. This should be treated as unconfirmed rather than ruled out.

Is there an official fix for this issue?

The record lists no fixed version. A missing entry does not prove that no fix exists, but the project is described as inactive, so verify with maintainers and consider compensating controls such as restricting uploads and validating files on the server.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.