CVE-2026-26699 Code injection in n/a

High 7.2 Published 2 Mar 2026 Updated 4 Mar 2026

Attackers can execute arbitrary code via the admin picture change feature in the Personnel Property Equipment System web application.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-26699?

CVE-2026-26699 is a high-severity code injection vulnerability in n/a, published on 2 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.

Weakness: CWE-94

Which versions are affected by CVE-2026-26699?

It affects 1 product.

Products include Jon-Remus-Sevellejo Personnel Property Equipment System.

How do I fix CVE-2026-26699?

No fix has been published for CVE-2026-26699 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-26699 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26699 exists.

Sources

Also known as GHSA-47ww-8q94-pgp6.