CVE-2026-6602 rickxy Hospital Management System his_admin_account.php unrestricted upload
Attackers can upload malicious files via the admin account profile picture field, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6602?
CVE-2026-6602 is a medium-severity vulnerability in rickxy Hospital Management System, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /backend/admin/his_admin_account.php. The manipulation of the argument ad_dpic results in unrestricted upload. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.
Which versions are affected by CVE-2026-6602?
How do I fix CVE-2026-6602?
No fix has been published for CVE-2026-6602 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6602 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6602 exists.
Sources
Also known as GHSA-pg7r-p32f-3m9r.