Skip to content
OpenAdvisories
High VA-26-313-01 1 CVE

U.S. Geological Survey Area Species Management Research Program unrestricted file upload

Published Nov 10, 2026 · Updated Nov 10, 2026

Vendor: U.S. Geological Survey Product: Area Species Management Research Program

Summary

U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed.

Vulnerabilities 1

  • High 8.8
    CVE-2026-107356

    U.S. Geological Survey Area Species Management Research Program unrestricted file upload

    U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from…

    U.S. Geological Survey Area Species Management Research Program

Revision history

  1. #1.0.0

    Initial publication