PT-2026-4533 · Sourcecodester · Modern Image Gallery App

Publicado 2026-01-23 · Atualizado 2026-01-25 · CVE-2025-70457

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Modern Image Gallery App version 1.0

Description A Remote Code Execution (RCE) issue exists in the gallery/upload.php component of the application. The application does not properly validate uploaded file contents and preserves user-supplied file extensions during the save process. This allows an unauthenticated attacker to upload arbitrary PHP code by spoofing the MIME type as an image, potentially leading to full system compromise. The vulnerable component is upload.php. The application fails to validate the file content.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict file uploads to known and trusted users only.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2025-70457

GHSA-8XQ6-HJHW-4983

Produtos afetados

Modern Image Gallery App

Referências · 7

• 🔥 https://github.com/ismaildawoodjee/vulnerability-research/security/advisories/GHSA-8xq6-hjhw-4983 · Exploit
• https://osv.dev/vulnerability/CVE-2025-70457 · Aviso do Fabricante
• https://sourcecodester.com/php/18572/modern-image-gallery-app-using-php-and-mysql-source-code.html · Nota
• https://t.me/CVEtracker/42887 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2014932216527139226 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-70457 · Nota de Segurança
• https://twitter.com/CVEnew/status/2015362500158791993 · Publicação no Twitter