PatchSiren cyber security CVE debrief
CVE-2026-10807 mjperpinosa CVE debrief
A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Executing a manipulation of the argument pr_profile_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
- Vendor
- mjperpinosa
- Product
- stumasy
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-04
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-04
Who should care
Users of mjperpinosa stumasy should be aware of this vulnerability, as it allows for unrestricted upload and can be exploited remotely.
Technical summary
The vulnerability is located in the file application/PHP/objects/profiles/change_profile_image.php, specifically in the argument pr_profile_image. This allows for unrestricted upload, which can be exploited remotely.
Defensive priority
LOW
Recommended defensive actions
- Review and monitor the project for updates and patches.
- Implement additional security measures to restrict file uploads.
Evidence notes
The vulnerability has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Official resources
Publicly disclosed