PT-2026-4533 · Sourcecodester · Modern Image Gallery App

Published 2026-01-23 · Updated 2026-01-25 · CVE-2025-70457

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Modern Image Gallery App version 1.0

Description A Remote Code Execution (RCE) issue exists in the gallery/upload.php component of the application. The application does not properly validate uploaded file contents and preserves user-supplied file extensions during the save process. This allows an unauthenticated attacker to upload arbitrary PHP code by spoofing the MIME type as an image, potentially leading to full system compromise. The vulnerable component is upload.php. The application fails to validate the file content.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict file uploads to known and trusted users only.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-70457

GHSA-8XQ6-HJHW-4983

Affected Products

Modern Image Gallery App

References · 7

• 🔥 https://github.com/ismaildawoodjee/vulnerability-research/security/advisories/GHSA-8xq6-hjhw-4983 · Exploit
• https://osv.dev/vulnerability/CVE-2025-70457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70457 · Security Note
• https://sourcecodester.com/php/18572/modern-image-gallery-app-using-php-and-mysql-source-code.html · Note
• https://t.me/CVEtracker/42887 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014932216527139226 · Twitter Post
• https://twitter.com/CVEnew/status/2015362500158791993 · Twitter Post