Description
U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| U.S. Geological Survey | Area Species Management Research Program | < 2026-07-20 | 2026-07-20 |
Advisories 1
- VA-26-313-01 U.S. Geological Survey Area Species Management Research Program unrestricted file upload CISA ICS & IT advisories · Nov 10, 2026