CVE-2026-2184: Great Developers Certificate Generation System OS Command Injection via photo Parameter

Overview

CVE-2026-2184 describes an OS command injection weakness in the Great Developers Certificate Generation System. According to the record, the flaw is in the file /restructured/csv.php and is triggered through the photo argument. The record states that the issue can be exploited remotely.

The product uses a rolling release model, and the upstream repository has not been active for many years.

Impact

The weakness is classified as CWE-78 (OS Command Injection).
NVD assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes high confidentiality, integrity and availability impact and no required privileges or user interaction.
VulDB, as CNA, lists scores of 7.3 (CVSS 3.1), 6.9 (CVSS 4.0) and 7.5 (CVSS 2.0).

The available sources do not describe the concrete consequences observed in any real deployment.

Affected products and versions

The record lists the product Greatdevelopers Certificate with the range ≤ 2017-10-16. The description refers to the project state up to commit 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. Because the product is a rolling release, no discrete affected or fixed version numbers are available.

Exploitation status

The record shows kev.listed as false, so this analysis does not state active exploitation or exploitation in the wild. No confirmed exploitation appears in the sources consulted. One referenced public repository is tagged as exploit-related; this analysis relies only on that tag and does not describe its content. The EPSS probability is 0.10681 with a percentile of 0.95729.

Remediation and mitigation

No vendor fix is listed in the record, so treat the product as unpatched.
If the application is not needed, remove it from internet-facing systems. If it is needed, restrict access to trusted networks only.
Because the upstream project is inactive, plan a migration to a maintained certificate generation solution.
Run the web application with minimal operating system privileges and limit what the web server process can execute.
Have developers review how user-supplied values reach system calls and move to strict allow-lists and safe APIs that do not invoke a shell.

Detection guidance

Review web server access logs for requests to the csv.php path that contain unusual or unexpected values in the photo parameter.
Monitor for child processes started by the web server or PHP runtime, which may indicate command execution.
Watch for new or modified files in web directories and for unexpected outbound connections from the server.

Limitations of the available information

No vendor advisory or fixed version is included in the record.
Version information is unavailable because the product is a rolling release, and the affected range is given as a date-based string whose exact meaning is not explained.
CVSS scores differ across providers and versions, so the record does not establish a single severity beyond NVD's 9.8.
The record does not confirm exploitation in the wild, and the EPSS date is later than the publication date.

Frequently asked questions

Is CVE-2026-2184 known to be actively exploited?

The record shows the CVE is not listed in CISA KEV, so this analysis does not claim active exploitation. No confirmed exploitation appears in the sources consulted.

Is there a fixed version for this vulnerability?

No fixed version is listed in the record. Because the product uses a rolling release model, version information is unavailable, so the product should be treated as unpatched.

What should administrators do now?

Restrict or remove internet exposure of the application, run it with minimal privileges, and plan migration to a maintained alternative since the upstream project is inactive.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.