CVE-2026-108973 SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload
Remote attackers can upload malicious files via unrestricted file upload in the user management module, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108973?
CVE-2026-108973 is a medium-severity vulnerability in SourceCodester Contact Tracing System, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Which versions are affected by CVE-2026-108973?
How do I fix CVE-2026-108973?
No fix has been published for CVE-2026-108973 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108973 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-108973 exists.
Sources
Also known as GHSA-wqfp-rm4r-2hj4.